fix: handle escaped dots in yaml lookups (#3450)

Author: margaretjgu

test/integration/test-builder.js

@@ -403,10 +403,27 @@ function indent (str, spaces) {
   return str.replace(/\s+$/, '').split('\n').map(l => `${tabs}${l}`).join('\n') + '\n'
 }
 
+function splitLookupPath (path) {
+  const steps = []
+  let cur = ''
+  for (let i = 0; i < path.length; i++) {
+    if (path[i] === '\\' && i + 1 < path.length) {
+      cur += path[++i]
+    } else if (path[i] === '.') {
+      steps.push(cur)
+      cur = ''
+    } else {
+      cur += path[i]
+    }
+  }
+  steps.push(cur)
+  return steps
+}
+
 function buildLookup (path) {
   if (path === '$body') return '(typeof response.body === "string" ? response.body : JSON.stringify(response.body))'
 
-  const outPath = path.split('.').map(step => {
+  const outPath = splitLookupPath(String(path)).map(step => {
     if (parseInt(step, 10).toString() === step) {
       return `?.[${step}]`
     } else if (step.match(/^\$[a-zA-Z0-9_]+$/)) {
@@ -416,7 +433,7 @@ function buildLookup (path) {
     } else if (step === '') {
       return ''
     } else {
-      return `?.['${step}']`
+      return `?.[${JSON.stringify(step)}]`
     }
   }).join('')
   return `response.body${outPath}`
@@ -470,3 +487,4 @@ function isPlainObject (obj) {
 }
 
 module.exports = build
+module.exports.buildLookup = buildLookup

test/unit/test-builder.test.ts

@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and contributors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { test } from 'tap'
+import { execFileSync } from 'node:child_process'
+
+const { buildLookup } = require('../integration/test-builder.js') as {
+  buildLookup: (path: string) => string
+}
+
+function evalLookup (path: string, body: unknown): unknown {
+  const expr = buildLookup(path)
+  const script = `const response = { body: ${JSON.stringify(body)} }; process.stdout.write(JSON.stringify(${expr}))`
+  return JSON.parse(execFileSync(process.execPath, ['-e', script], { encoding: 'utf8' }))
+}
+
+function assertValidJs (t: { doesNotThrow: (fn: () => void) => void }, path: string): void {
+  const expr = buildLookup(path)
+  t.doesNotThrow(() => execFileSync(process.execPath, ['-e', `const response = {body:{}}; ${expr}`]))
+}
+
+test('escaped dots stay one key', t => {
+  t.equal(buildLookup('logs\\.otel.enabled'), 'response.body?.["logs.otel"]?.["enabled"]')
+  t.equal(evalLookup('logs\\.otel.enabled', { 'logs.otel': { enabled: true } }), true)
+  t.end()
+})
+
+test('plain dotted path still splits', t => {
+  t.equal(evalLookup('foo.bar', { foo: { bar: 1 } }), 1)
+  t.end()
+})
+
+test('numeric path segment is an index', t => {
+  t.equal(evalLookup('0.name', [{ name: 'a' }]), 'a')
+  t.end()
+})
+
+test('$body is the raw body', t => {
+  t.match(buildLookup('$body'), /response\.body/)
+  t.end()
+})
+
+test('quote and slash in a key stay valid js', t => {
+  t.equal(buildLookup("foo.bar'baz"), 'response.body?.["foo"]?.["bar\'baz"]')
+  t.equal(evalLookup("foo.bar'baz", { foo: { "bar'baz": 2 } }), 2)
+  assertValidJs(t, 'logs\\.otel.enabled')
+  t.end()
+})
+
+test('adversarial path segments stay valid js', t => {
+  assertValidJs(t, '../')
+  assertValidJs(t, '?#')
+  t.equal(evalLookup('?#', { '?#': 4 }), 4)
+  t.same(evalLookup('', { x: 1 }), { x: 1 })
+  t.end()
+})