Encapsulate column names for columns parameter

api_tabular/core/query.py

@@ -30,7 +30,7 @@ def build_sql_query_string(
         # is(not)null also has this syntax but is a filter
         elif len(_split) == 1:
             if _split[0].split("__")[1] in ["isnull", "isnotnull"]:
-                _filter, _ = add_filter(_split[0], None)
+                _filter, _ = add_filter(_split[0], "")
                 sql_query.append(_filter)
             else:
                 column, operator = add_aggregator(_split[0], indexes)
@@ -79,7 +79,7 @@ def get_column_and_operator(argument: str) -> tuple[str, str]:
 
 def add_filter(
     argument: str,
-    value: str | None,
+    value: str,
     *,
     in_operator: bool = False,
 ) -> tuple[str | None, bool]:
@@ -90,7 +90,10 @@ def add_filter(
     if argument == "columns":
         if in_operator:
             raise ValueError(f"Argument `{argument}` can't be set within an operator")
-        return f"select={value}", False
+        if '"' in value:
+            raise ValueError('Forbidden character `"` in a column name')
+        columns = ",".join(f'"{col}"' for col in value.split(","))
+        return f"select={columns}", False
     if "__" in argument:
         column, normalized_comparator = get_column_and_operator(argument)
         # when encapsulated in an OR statement, the syntax is `col.eq.val` instead of `col=eq.val`
@@ -209,7 +212,7 @@ def parse_operator(query: str, operator: str, top_level: bool = False):
                 postgrest_params.append(
                     add_filter(
                         param.replace('"', ""),
-                        None,
+                        "",
                         in_operator=True,
                     )[0]
                 )

db/initdb/0-init.sql

@@ -1129,7 +1129,8 @@ CREATE TABLE "csvapi".a6311c164ebfb165ddc828ded (
     "nom ""propre""" integer,
     "date/de\naissance" integer,
     "[nom peu] commun]" integer,
-    "avec__des!" integer
+    "avec__des!" integer,
+    "Taux de logements vacants* (en %)" integer
 );
 
 
@@ -1168,11 +1169,11 @@ ALTER TABLE ONLY "csvapi".a6311c164ebfb165ddc828ded ALTER COLUMN __id SET DEFAUL
 -- Data for Name: a6311c164ebfb165ddc828ded; Type: TABLE DATA; Schema: csvapi; Owner: csvapi
 --
 
-COPY "csvapi".a6311c164ebfb165ddc828ded (__id, "Titre de l'œuvre", "nom.de.colonne", "%dès_àccênts?", "nom ""propre""", "date/de\naissance", "[nom peu] commun]", "avec__des!") FROM stdin;
-1	10	20	30	40	50	60	70
-2	11	21	31	41	51	61	71
-3	12	22	32	42	52	62	72
-4	13	23	33	43	53	63	73
+COPY "csvapi".a6311c164ebfb165ddc828ded (__id, "Titre de l'œuvre", "nom.de.colonne", "%dès_àccênts?", "nom ""propre""", "date/de\naissance", "[nom peu] commun]", "avec__des!", "Taux de logements vacants* (en %)") FROM stdin;
+1	10	20	30	40	50	60	70	80
+2	11	21	31	41	51	61	71	81
+3	12	22	32	42	52	62	72	82
+4	13	23	33	43	53	63	73	83
 \.
 
 

tests/test_query.py

@@ -244,7 +244,7 @@ def test_query_aggregators(allow_aggregation, mocker):
 def test_query_specify_columns():
     query_str = ["columns=col1,col2"]
     result = build_sql_query_string(query_str)
-    assert result == "select=col1,col2&order=__id.asc"
+    assert result == 'select="col1","col2"&order=__id.asc'
 
 
 def test_query_specify_columns_and_aggregate():