fix: properly escape GraphQL strings in Linear mutations

2025-10-07 17:03:35 +05:30
2 changed files with 4 additions and 4 deletions
@@ -156,8 +156,7 @@ class ConversationFinder
  def filter_by_labels
    return unless params[:labels]

-    pattern = params[:labels].map { |label| Regexp.escape(label) }.join('|')
-    @conversations = @conversations.where('cached_label_list ~ ?', "\\y(#{pattern})\\y")
+    @conversations = @conversations.tagged_with(params[:labels], any: true)
  end

  def filter_by_source_id
@@ -2,8 +2,9 @@ module Linear::Mutations
  def self.graphql_value(value)
    case value
    when String
-      # Strings must be enclosed in double quotes
-      "\"#{value.gsub("\n", '\\n')}\""
+      # Strings must be enclosed in double quotes and properly escaped
+      escaped = value.gsub('\\', '\\\\').gsub('"', '\\"').gsub("\n", '\\n').gsub("\r", '\\r').gsub("\t", '\\t')
+      "\"#{escaped}\""
    when Array
      # Arrays need to be recursively converted
      "[#{value.map { |v| graphql_value(v) }.join(', ')}]"