fix(plugins): view quoting, SQL injection, pagination, and misc SQL fixes - #1926
fix(plugins): view quoting, SQL injection, pagination, and misc SQL fixes#1926HandSonic wants to merge 6 commits into
Conversation
openai0229
left a comment
openai0229
left a comment
There was a problem hiding this comment.
This PR combines six independent behavior changes across Oracle, PostgreSQL, and SQL Server without focused dialect tests. Please split it by dialect/behavior so each fix has a clear contract and regression coverage.
At minimum, the tests need to prove Oracle pagination with both bounds after the new wrapping behavior, real SQL Server sp_rename quoting syntax, SQL Server TIMESTAMP/rowversion DDL behavior, and view/comment quoting for each affected dialect. After splitting and testing, please update each branch with the current main.
|
Rechecked against current |
…ent SQL - View name was quoted with backticks (MySQL syntax) instead of double quotes - Comment SQL was missing DOT separator between schema and view name, producing "schema""view" instead of "schema"."view"
View name was quoted with backticks (MySQL syntax) instead of square brackets (SQL Server syntax).
View comment SQL was missing DOT between schema and view name identifiers, producing "SCOTT""MY_VIEW" instead of "SCOTT"."MY_VIEW".
tableName was concatenated directly into SQL without escaping. Table names
containing single quotes (e.g. O'Brien) would break SQL syntax or allow
injection. Now escapes single quotes with replace("'", "''").
When offset==0 (first page), the outer SELECT * FROM (...) wrapper was skipped, leaking CAHT2DB_AUTO_ROW_ID into the result set. Now both wrappers are always applied for consistent column schema across pages.
- Arrays.asList() was empty, making TIMESTAMP precision block dead code.
Now uses Arrays.asList('TIMESTAMP') to enable the code path.
- RENAME_COLUMN_SCRIPT parameters now use square bracket quoting for
names with spaces or reserved words.
- COLUMN_MODIFY_COMMENT_SCRIPT now ends with 'go\n' (with trailing
newline) so the batch separator is recognized when concatenated.
407518e to
7df051d
Compare
2 participants
Summary
Fixes 6 verified bugs across PostgreSQL, SQL Server, and Oracle database plugins.
Fixes included:
replace("'", "''")Arrays.asList()→Arrays.asList("TIMESTAMP")), GO separator trailing newline, rename script bracket quoting