JSON_SEARCH returns a path that does not locate the value it points at when the key needs quoting

JSON_SEARCH returns the path to a value. The path it composes writes
member names raw after a dot, with no quoting, so a key holding a dot, a
bracket or a quote produces a path that does not find the value it was
built for.

SELECT JSON_SEARCH('{"a.b":"V"}', 'one', 'V') AS p;

p

"$.a.b"

SELECT JSON_EXTRACT('{"a.b":"V"}',

       JSON_UNQUOTE(JSON_SEARCH('{"a.b":"V"}','one','V'))) AS back;

back

NULL

`$.a.b` names a member b of a member a. The document has one member,
named `a.b`.

How to repeat

SELECT JSON_SEARCH('{"a.b":"V"}',   'one', 'V') AS dot;      -- "$.a.b"

SELECT JSON_SEARCH('{"a[0]":"V"}',  'one', 'V') AS bracket;  -- "$.a[0]"

SELECT JSON_SEARCH('{"a\"b":"V"}', 'one', 'V') AS quote;    -- "$.a"b"

-- none of the three round-trips

SELECT JSON_EXTRACT('{"a.b":"V"}',

       JSON_UNQUOTE(JSON_SEARCH('{"a.b":"V"}','one','V')))  AS back;  -- NULL

SELECT JSON_EXTRACT('{"a[0]":"V"}',

       JSON_UNQUOTE(JSON_SEARCH('{"a[0]":"V"}','one','V'))) AS back;  -- NULL

A key holding a space is the one awkward name that happens to survive
the trip.

Root cause

`append_json_path()` writes a dot and then the key's bytes as they
stand. The path grammar has a form for exactly this case - the
JSONPath help topic (395) documents `."memberName"` as *"the same as
above but allows one to select a member with a name that's not a valid
identifier (that is, has space, dot, and/or other characters)"* - and
the composer does not use it.

Contract, `scripts/fill_help_tables.sql:462` (topic 388): *"Returns the
path to the given string within a JSON document."*

Affected versions

JSON_SEARCH was added in 10.2.3.

Verified on 10.11 only (10.11.19-MariaDB-debug, commit 1dab253482d).
Other branches were not tested.

Note

Found while auditing the JSON functions against their documented
contracts. None. func_json.test:285-289 covers a quote in the
searched value, never in a key on the composed path.