Skip to content

fix(jdbc): escape resolved table name in getExportedKeys query#1430

Open
dxbjavid wants to merge 1 commit into
xerial:masterfrom
dxbjavid:getexportedkeys-pktablename-escape
Open

fix(jdbc): escape resolved table name in getExportedKeys query#1430
dxbjavid wants to merge 1 commit into
xerial:masterfrom
dxbjavid:getexportedkeys-pktablename-escape

Conversation

@dxbjavid

Copy link
Copy Markdown
Contributor

getExportedKeys builds its PKTABLE_NAME from the table name it reads back out of sqlite_schema, the case-correct form stored when the table was created, and that value goes into the query through quote() on its own without escape(). Every other identifier in these foreign-key queries already passes through escape(), and the recent catalog/schema change covered the caller-supplied arguments, but this resolved name was left raw. A table created with a single quote in its name (a legal quoted identifier) then breaks out of the literal when getExportedKeys is called for it, so the generated metadata query either errors or can be steered, the same second-order injection getColumns had. I noticed it while going back over the remaining quote() calls in the file after the earlier fixes landed. Routing target through escape() before quote() closes it and lines up with how the surrounding values are handled. I have added a regression test that creates a quoted-name parent table with a child foreign key pointing at it.

@gotson

gotson commented Jun 17, 2026

Copy link
Copy Markdown
Collaborator

thanks for the PR, can you check the code formatting that is failing ?

@dxbjavid dxbjavid force-pushed the getexportedkeys-pktablename-escape branch from d43d9f0 to abe468a Compare June 17, 2026 12:18
@dxbjavid

Copy link
Copy Markdown
Contributor Author

good catch, that was a comment line spilling past the line limit. wrapped it so spotless:check is happy now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants