fix(jdbc): escape resolved table name in getExportedKeys query#1430
Open
dxbjavid wants to merge 1 commit into
Open
fix(jdbc): escape resolved table name in getExportedKeys query#1430dxbjavid wants to merge 1 commit into
dxbjavid wants to merge 1 commit into
Conversation
Collaborator
|
thanks for the PR, can you check the code formatting that is failing ? |
d43d9f0 to
abe468a
Compare
Contributor
Author
|
good catch, that was a comment line spilling past the line limit. wrapped it so spotless:check is happy now. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
getExportedKeys builds its PKTABLE_NAME from the table name it reads back out of sqlite_schema, the case-correct form stored when the table was created, and that value goes into the query through quote() on its own without escape(). Every other identifier in these foreign-key queries already passes through escape(), and the recent catalog/schema change covered the caller-supplied arguments, but this resolved name was left raw. A table created with a single quote in its name (a legal quoted identifier) then breaks out of the literal when getExportedKeys is called for it, so the generated metadata query either errors or can be steered, the same second-order injection getColumns had. I noticed it while going back over the remaining quote() calls in the file after the earlier fixes landed. Routing target through escape() before quote() closes it and lines up with how the surrounding values are handled. I have added a regression test that creates a quoted-name parent table with a child foreign key pointing at it.