Escape backslashes in query tag keys

Co-authored-by: Isaac

Author: jiabin-hu

lib/utils/queryTags.ts

@@ -3,8 +3,8 @@
  *
  * Format: comma-separated key:value pairs, e.g. "key1:value1,key2:value2"
  * - If a value is null or undefined, the key is included without a colon or value
+ * - Backslashes in keys are escaped; other special characters in keys are not escaped
  * - Special characters (backslash, colon, comma) in values are backslash-escaped
- * - Keys are not escaped
  *
  * @param queryTags - dictionary of query tag key-value pairs
  * @returns serialized string, or undefined if input is empty/null/undefined
@@ -23,12 +23,13 @@ export function serializeQueryTags(
 
   return keys
     .map((key) => {
+      const escapedKey = key.replace(/\\/g, '\\\\');
       const value = queryTags[key];
       if (value == null) {
-        return key;
+        return escapedKey;
       }
       const escapedValue = value.replace(/[\\:,]/g, (c) => `\\${c}`);
-      return `${key}:${escapedValue}`;
+      return `${escapedKey}:${escapedValue}`;
     })
     .join(',');
 }

tests/unit/utils/queryTags.test.ts

@@ -52,7 +52,15 @@ describe('serializeQueryTags', () => {
     expect(serializeQueryTags({ val: 'a\\b:c,d' })).to.equal('val:a\\\\b\\:c\\,d');
   });
 
-  it('should not escape special characters in keys', () => {
+  it('should escape backslash in key', () => {
+    expect(serializeQueryTags({ 'a\\b': 'value' })).to.equal('a\\\\b:value');
+  });
+
+  it('should escape backslash in key with null value', () => {
+    expect(serializeQueryTags({ 'a\\b': null })).to.equal('a\\\\b');
+  });
+
+  it('should not escape other special characters in keys', () => {
     expect(serializeQueryTags({ 'key:name': 'value' })).to.equal('key:name:value');
   });
 });