From 8a41fd0b0cae15da4ea4cce327ad00a2ce225b3c Mon Sep 17 00:00:00 2001
From: zstadler <zeev.stadler@gmail.com>
Date: Wed, 13 Nov 2024 23:18:43 +0100
Subject: [PATCH] Escaping names passed to Overpass (#2074)

* Escaping names passed to Overpass

Resolves #2073

* Add tests for relevant scenario

* Fix lint, improve coverage

---------

Co-authored-by: HarelM <harel.mazor@gmail.com>
---
 .../services/overpass-turbo.service.spec.ts   | 77 +++++++++++++++++++
 .../services/overpass-turbo.service.ts        |  5 +-
 2 files changed, 80 insertions(+), 2 deletions(-)
 create mode 100644 IsraelHiking.Web/src/application/services/overpass-turbo.service.spec.ts

diff --git a/IsraelHiking.Web/src/application/services/overpass-turbo.service.spec.ts b/IsraelHiking.Web/src/application/services/overpass-turbo.service.spec.ts
new file mode 100644
index 000000000..c3457f28d
--- /dev/null
+++ b/IsraelHiking.Web/src/application/services/overpass-turbo.service.spec.ts
@@ -0,0 +1,77 @@
+import { inject, TestBed } from "@angular/core/testing";
+import { provideHttpClient, withInterceptorsFromDi } from "@angular/common/http";
+import { HttpTestingController, provideHttpClientTesting } from "@angular/common/http/testing";
+import { OverpassTurboService } from "./overpass-turbo.service";
+
+describe("OverpassTurboService", () => {
+    beforeEach(() => {
+        TestBed.configureTestingModule({
+            imports: [],
+            providers: [
+                OverpassTurboService,
+                provideHttpClient(withInterceptorsFromDi()),
+                provideHttpClientTesting()
+            ]
+        });
+    });
+
+    it("Should get a long way by name", inject([OverpassTurboService, HttpTestingController], async (service: OverpassTurboService, mockBackend: HttpTestingController) => {
+        // Arrange
+        const response = "<osm></osm>";
+        // Act
+        const promise = service.getLongWay("id", "name", false, false);
+
+        mockBackend.expectOne("https://overpass-api.de/api/interpreter").flush(response);
+        // Assert
+        const results = await promise;
+        expect(results.features.length).toBe(0);
+    }));
+
+    it("Should get a long mtb way by name", inject([OverpassTurboService, HttpTestingController], async (service: OverpassTurboService, mockBackend: HttpTestingController) => {
+        // Arrange
+        const response = "<osm></osm>";
+        // Act
+        const promise = service.getLongWay("id", "aaa", false, true);
+
+        mockBackend.expectOne(u => u.body.includes("mtb:name")).flush(response);
+        // Assert
+        const results = await promise;
+        expect(results.features.length).toBe(0);
+    }));
+
+    it("Should get a long waterway way by name", inject([OverpassTurboService, HttpTestingController], async (service: OverpassTurboService, mockBackend: HttpTestingController) => {
+        // Arrange
+        const response = "<osm></osm>";
+        // Act
+        const promise = service.getLongWay("id", "aaa", true, false);
+
+        mockBackend.expectOne(u => u.body.includes("waterway")).flush(response);
+        // Assert
+        const results = await promise;
+        expect(results.features.length).toBe(0);
+    }));
+
+    it("Should get a long way by name with '\"'", inject([OverpassTurboService, HttpTestingController], async (service: OverpassTurboService, mockBackend: HttpTestingController) => {
+        // Arrange
+        const response = "<osm></osm>";
+        // Act
+        const promise = service.getLongWay("id", "lalala\"", false, false);
+
+        mockBackend.expectOne(u => u.body.includes("lalala\\\"")).flush(response);
+        // Assert
+        const results = await promise;
+        expect(results.features.length).toBe(0);
+    }));
+
+    it("Should get a place by id", inject([OverpassTurboService, HttpTestingController], async (service: OverpassTurboService, mockBackend: HttpTestingController) => {
+        // Arrange
+        const response = "<osm></osm>";
+        // Act
+        const promise = service.getPlaceGeometry("42");
+
+        mockBackend.expectOne("https://overpass-api.de/api/interpreter").flush(response);
+        // Assert
+        const results = await promise;
+        expect(results.features.length).toBe(0);
+    }));
+});
\ No newline at end of file
diff --git a/IsraelHiking.Web/src/application/services/overpass-turbo.service.ts b/IsraelHiking.Web/src/application/services/overpass-turbo.service.ts
index a4048eb63..04d8fa68c 100644
--- a/IsraelHiking.Web/src/application/services/overpass-turbo.service.ts
+++ b/IsraelHiking.Web/src/application/services/overpass-turbo.service.ts
@@ -34,14 +34,15 @@ export class OverpassTurboService {
         }
     }
 
-    public async getLongWay(id: string, title: string, isWaterway: boolean, isMtbRoute: boolean): Promise<GeoJSON.FeatureCollection> {
+    public async getLongWay(id: string, name: string, isWaterway: boolean, isMtbRoute: boolean): Promise<GeoJSON.FeatureCollection> {
+        const quotedName = name.replace(/"/g, '\\"')
         const query = `
         way(${id});
         complete
         {
           way(around:30)
             [${isWaterway ? 'waterway' : 'highway'}]
-            ["${isMtbRoute ? 'mtb:name' : 'name'}"="${title}"];
+            ["${isMtbRoute ? 'mtb:name' : 'name'}"="${quotedName}"];
         }
         out geom;`;
         return await this.getGeoJsonFromQuery(query);