fix: quote table and column identifiers in mssql, mysql, sqlite and libsql queries - #77
Open
xavpain wants to merge 2 commits into
Open
fix: quote table and column identifiers in mssql, mysql, sqlite and libsql queries#77xavpain wants to merge 2 commits into
xavpain wants to merge 2 commits into
Conversation
Table and column names were interpolated raw into count and paging queries. A table named after a T-SQL reserved word (User, Order, Group, ...) broke the overview, tables list, table page and table data endpoints with 'Incorrect syntax near the keyword'. Add quote_ident that wraps identifiers in [] and escapes ] and use it at every interpolation site in the mssql module. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014KHtEx6XUzzfa8QHsEUP9p
Same class of bug as the mssql fix: mysql interpolated table names raw into count(*) and SELECT * queries, and sqlite/libsql left the ORDER BY column unquoted. A table or first column named after a reserved word (order, group, key, ...) broke those pages. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014KHtEx6XUzzfa8QHsEUP9p
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #76
Problem
Table and column names were interpolated raw into the
count(*)and paging queries. Any table named after a reserved word (User,Order,Group, ...) broke the overview, tables list, table page and table data endpoints:Change
quote_ident(bracket quoting,]doubled) and use it at all four interpolation sites (overview count, tables count, table count, table dataFROM+ORDER BY).`doubled).ORDER BY {first_column}was not. Quote it with"...".postgres, duckdb, parquet, csv and clickhouse already quote identifiers, no change there.
Tested
Usertable (190 tables):/api/,/api/tables,/api/tables/User,/api/tables/User/data?page=1all return 200 (previously 500 on the overview)."order"whose columns are"group"and"select": table data page returns rows sorted by"group".🤖 Generated with Claude Code
https://claude.ai/code/session_014KHtEx6XUzzfa8QHsEUP9p