batch-rename-utilities: escape strings in the sparql query

The sparql query will fail if the file name or the parent uri have a
character that needs escaping. An example would be the character '

To fix this, escape the file name and the parent uri in the query.

https://bugzilla.gnome.org/show_bug.cgi?id=770944

1 files changed, 9 insertions, 4 deletions

diff --git a/src/nautilus-batch-rename-utilities.c b/src/nautilus-batch-rename-utilities.c
index bac61cb3f..d87884de4 100644
--- a/src/nautilus-batch-rename-utilities.c
+++ b/src/nautilus-batch-rename-utilities.c
@@ -1020,6 +1020,8 @@ check_metadata_for_selection (NautilusBatchRenameDialog *dialog,
     GList *selection_metadata;
     guint i;
     g_autofree gchar *parent_uri = NULL;
+    g_autofree gchar *parent_uri_escaped = NULL;
+    gchar *file_name_escaped;
 
     error = NULL;
     selection_metadata = NULL;
@@ -1043,33 +1045,35 @@ check_metadata_for_selection (NautilusBatchRenameDialog *dialog,
                           "WHERE { ?file a nfo:FileDataObject. ");
 
     parent_uri = nautilus_file_get_parent_uri (NAUTILUS_FILE (selection->data));
+    parent_uri_escaped = g_markup_escape_text (parent_uri, -1);
 
     g_string_append_printf (query,
                             "FILTER(tracker:uri-is-parent('%s', nie:url(?file))) ",
-                            parent_uri);
+                            parent_uri_escaped);
 
     for (l = selection; l != NULL; l = l->next)
     {
         file = NAUTILUS_FILE (l->data);
         file_name = nautilus_file_get_name (file);
+        file_name_escaped = g_markup_escape_text (file_name, -1);
 
         if (l == selection)
         {
             g_string_append_printf (query,
                                     "FILTER (nfo:fileName(?file) IN ('%s', ",
-                                    file_name);
+                                    file_name_escaped);
         }
         else if (l->next == NULL)
         {
             g_string_append_printf (query,
                                     "'%s')) ",
-                                    file_name);
+                                    file_name_escaped);
         }
         else
         {
             g_string_append_printf (query,
                                     "'%s', ",
-                                    file_name);
+                                    file_name_escaped);
         }
 
         file_metadata = g_new0 (FileMetadata, 1);
@@ -1079,6 +1083,7 @@ check_metadata_for_selection (NautilusBatchRenameDialog *dialog,
         selection_metadata = g_list_prepend (selection_metadata, file_metadata);
 
         g_free (file_name);
+        g_free (file_name_escaped);
     }
 
     selection_metadata = g_list_reverse (selection_metadata);