fix(xugudb): escape SQL identifiers and literals in metadata/DDL paths (#1914) - #2175
Merged
Conversation
HandSonic
marked this pull request as draft
July 26, 2026 10:30
HandSonic
marked this pull request as ready for review
July 26, 2026 11:05
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…olumn fallback (OtterMind#1914) - Override quoteIdentifier/quoteQualifiedIdentifier/buildSelectTable/buildTableName/ buildColumns in XUGUDBSqlBuilder so inherited DefaultSqlBuilder DQL/DML paths (exportTableData, insert, update) no longer concatenate raw identifiers - Replace raw IColumnBuilder.buildDefaultColumn fallback with escaped name + anchored type-shape validation (reject otherwise) - Return trimmed values from default-value/unit validators - Document raw-identifier contract on XugudbSqlEscapes.escapeIdentifier - Add attack-string tests: malicious schema/table/column via buildSelectTable and buildInsert, comment literal end-to-end, fallback name/type, validator trimming
… tests (OtterMind#1914) - DEFAULT_VALUE_PATTERN function-call branch now requires balanced single-quoted literals as arguments ('([^']|'')*' allowed, bare quotes rejected), closing the unbalanced-quote gap in default-value validation - Add tests: unbalancedQuoteInFunctionDefaultIsRejected, balancedQuotedArgsInFunctionDefaultAreAccepted - Fix extra closing paren typo in the c3 case
…intainer review (OtterMind#1914) - new XugudbIdentifierProcessor (SPI ISQLIdentifierProcessor): quoteIdentifier with double-quote doubling, escapeString with single-quote doubling - XUGUDBMetaData overrides getSQLIdentifierProcessor(); metadata call sites use it - builder/manager/enums use XugudbIdentifierProcessor.INSTANCE - non-escapable validation moved to XugudbSqlGuards (column defaults, length units) - XugudbSqlEscapes removed; tests migrated (21 green)
…rough, conditional for SPI, always for DDL) (OtterMind#1914) Found in re-review: processor was always-quote with null->"" garbage, breaking SPI completion paths; no quoteIdentifierAlways existed.
openai0229
force-pushed
the
fix/sqli-xugudb
branch
from
July 29, 2026 09:10
52d2088 to
5aa92fe
Compare
openai0229
approved these changes
Jul 29, 2026
openai0229
left a comment
openai0229
left a comment
Contributor
There was a problem hiding this comment.
Maintainer review complete. Rebased onto current main, fixed XuguDB identifier/default/type/builder semantics, and verified with the nine-module clean reactor suite (195/195 tests passed).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue
Closes #1914
Summary
Completes the XuguDB database-plugin portion of the identifier and literal escaping work.
XugudbIdentifierProcessorwith conditional SPI quoting, DDL-only always quoting, locale-independent reserved-word matching, null preservation, and embedded/boundary double-quote round trips.Affected surfaces
Verification
mvn -B -f chat2db-community-server/pom.xml -pl chat2db-community-plugins/chat2db-community-xugudb -am clean test -DskipTests=false -Dmaven.test.skip=false -Dsurefire.failIfNoSpecifiedTests=falseBUILD SUCCESSacross 9 reactor modules; 195 tests passed in tested modules, including XuguDB35/35, Oracle44/44, SPI90/90, and tools26/26.git diff --check origin/main...HEAD: passed.Risk and compatibility
ISQLIdentifierProcessorcontract.Reviewer map
XugudbIdentifierProcessor,XugudbSqlGuards, thenXUGUDBSqlBuilder,XUGUDBMetaData, and the type/index enums.Contributor declaration
AI assistance: Substantial AI-assisted maintainer revision, multi-agent review, and test expansion; all final changes were source-reviewed and verified with the commands above.