From 5b27bcd7814350a0ad26a4450fae497451aa730a Mon Sep 17 00:00:00 2001
From: Dave Conway-Jones <conway@uk.ibm.com>
Date: Sun, 16 Oct 2022 18:05:21 +0100
Subject: [PATCH] CSV node check header properties for ' and "

and add test
to close #3919
---
 .../@node-red/nodes/core/parsers/70-CSV.js    |  5 +++-
 test/nodes/core/parsers/70-CSV_spec.js        | 27 +++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/packages/node_modules/@node-red/nodes/core/parsers/70-CSV.js b/packages/node_modules/@node-red/nodes/core/parsers/70-CSV.js
index 39d03f05c..ca193c2b9 100644
--- a/packages/node_modules/@node-red/nodes/core/parsers/70-CSV.js
+++ b/packages/node_modules/@node-red/nodes/core/parsers/70-CSV.js
@@ -135,7 +135,10 @@ module.exports = function(RED) {
                                             ou += node.sep;
                                         }
                                         else {
-                                            var p = RED.util.getMessageProperty(msg,"payload["+s+"]['"+template[t]+"']");
+                                            var tt = template[t];
+                                            if (template[t].indexOf('"') >=0 ) { tt = "'"+tt+"'"; }
+                                            else { tt = '"'+tt+'"'; }
+                                            var p = RED.util.getMessageProperty(msg,'payload["'+s+'"]['+tt+']');
                                             /* istanbul ignore else */
                                             if (p === undefined) { p = ""; }
                                             // fix to honour include null values flag
diff --git a/test/nodes/core/parsers/70-CSV_spec.js b/test/nodes/core/parsers/70-CSV_spec.js
index d56f05db3..681711b3b 100644
--- a/test/nodes/core/parsers/70-CSV_spec.js
+++ b/test/nodes/core/parsers/70-CSV_spec.js
@@ -766,6 +766,33 @@ describe('CSV node', function() {
             });
         });
 
+        it('should handle a template with quotes in the property names', function(done) {
+            var flow = [ { id:"n1", type:"csv", temp:"", hdrout:"all", wires:[["n2"]] },
+                {id:"n2", type:"helper"} ];
+            helper.load(csvNode, flow, function() {
+                var n1 = helper.getNode("n1");
+                var n2 = helper.getNode("n2");
+                n2.on("input", function(msg) {
+                    try {
+                        msg.should.have.property('payload', 'a"a,b\'b\nA1,B1\nA2,B2\n');
+                        done();
+                    }
+                    catch(e) { done(e); }
+                });
+                var testJson = [
+                    {
+                        "a\"a": "A1",
+                        "b'b": "B1"
+                    },
+                    {
+                        "a\"a": "A2",
+                        "b'b": "B2"
+                    }
+                ]
+                n1.emit("input", {payload:testJson});
+            });
+        });
+
         it('should convert an array of objects to a multi-line csv', function(done) {
             var flow = [ { id:"n1", type:"csv", temp:"a,d,c,b", wires:[["n2"]] },
                 {id:"n2", type:"helper"} ];