escape Cypher parameters

Author: johnymontana

src/translate/translate.js

@@ -1490,7 +1490,7 @@ export const processFilterArgument = ({
     : undefined;
   const filterParamKey =
     paramIndex > 1 ? `${paramIndex - 1}_${argumentName}` : argumentName;
-  const filterCypherParam = `$${filterParamKey}`;
+  const filterCypherParam = `$\`${filterParamKey}\``;
   let translations = [];
   // allows an exception for the existence of the filter argument AST
   // if isFederatedOperation
@@ -2969,9 +2969,9 @@ export const translateListArguments = ({
       const paramIndex = indexedParam.index;
       const field = schemaType.getFields()[argumentName];
       const listVariable = `${safeVariableName}.${safeVar(argumentName)}`;
-      let paramPath = `$${argumentName}`;
+      let paramPath = `$\`${argumentName}\``;
       // Possibly use the already generated index used when naming nested parameters
-      if (paramIndex >= 1) paramPath = `$${paramIndex}_${argumentName}`;
+      if (paramIndex >= 1) paramPath = `$\`${paramIndex}_${argumentName}\``;
       let translation = '';
       if (field) {
         // list argument matches the name of a field

src/utils.js

@@ -146,7 +146,7 @@ export function cypherDirectiveArgs(
       federatedOperationParams[e] === undefined
     ) {
       // Use only if value exists
-      args.push(`${e}: $${paramIndex}_${e}`);
+      args.push(`${e}: $\`${paramIndex}_${e}\``);
     }
   });
   // Return the comma separated join of all param
@@ -306,11 +306,13 @@ export function innerFilterParams(
 export function paramsToString(params, cypherParams) {
   if (params.length > 0) {
     const strings = _.map(params, param => {
-      return `${param.key}:${param.paramKey ? `$${param.paramKey}.` : '$'}${
+      return `${param.key}:${
+        param.paramKey ? `$\`${param.paramKey}\`.` : '$`'
+      }${
         !param.value || typeof param.value.index === 'undefined'
           ? param.key
           : `${param.value.index}_${param.key}`
-      }`;
+      }\``;
     });
     return `{${strings.join(', ')}${
       cypherParams ? `, cypherParams: $cypherParams}` : '}'