You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
LibSqlUtils.escape() no-quote guard uses == 1 instead of == -1, leaving some values un-escaped #68
LibSqlUtils.escape() doubles single quotes for values embedded in the concatenated metadata SQL (pragma index_list / index_info / foreign_key_list and related DatabaseMetaData queries).
The early-return guard reads value.indexOf('\'') == 1 instead of == -1. The intent is "return the value unchanged when it contains no single quote", i.e. when indexOf returns -1. With == 1, any value whose first single quote is at index 1 (e.g. x') is returned un-escaped, so the quote closes the surrounding string literal — a correctness/SQL-injection hazard in metadata queries built from such values.
Expected
Values are returned unchanged only when they contain no single quote; otherwise every single quote is doubled.
Activity
dbeaver#68 fix(libsql): correct escape() no-quote guard (was == 1, sh…
#68 fix(libsql): correct escape() no-quote guard (was == 1, should be…