diff --git a/com.dbeaver.jdbc.driver.libsql/src/main/java/com/dbeaver/jdbc/driver/libsql/LibSqlUtils.java b/com.dbeaver.jdbc.driver.libsql/src/main/java/com/dbeaver/jdbc/driver/libsql/LibSqlUtils.java index 4bcc5e3..240de29 100644 --- a/com.dbeaver.jdbc.driver.libsql/src/main/java/com/dbeaver/jdbc/driver/libsql/LibSqlUtils.java +++ b/com.dbeaver.jdbc.driver.libsql/src/main/java/com/dbeaver/jdbc/driver/libsql/LibSqlUtils.java @@ -50,7 +50,7 @@ public static String unquote(String name) { } public static String escape(final String val) { - if (val.indexOf('\'') == 1) { + if (val.indexOf('\'') == -1) { return val; } int len = val.length(); diff --git a/com.dbeaver.jdbc.driver.libsql/src/test/java/com/dbeaver/jdbc/upd/driver/test/LibSqlUtilsTest.java b/com.dbeaver.jdbc.driver.libsql/src/test/java/com/dbeaver/jdbc/upd/driver/test/LibSqlUtilsTest.java index 46f7233..239d23e 100644 --- a/com.dbeaver.jdbc.driver.libsql/src/test/java/com/dbeaver/jdbc/upd/driver/test/LibSqlUtilsTest.java +++ b/com.dbeaver.jdbc.driver.libsql/src/test/java/com/dbeaver/jdbc/upd/driver/test/LibSqlUtilsTest.java @@ -45,4 +45,23 @@ public void testFormatUrl() throws LibSqlException { private void assertUrlFormat(String input, String expected) throws LibSqlException { Assertions.assertEquals(expected, LibSqlUtils.validateAndFormatUrl(input)); } + + @Test + public void testEscape() { + // No quote: returned unchanged. + Assertions.assertEquals("table", LibSqlUtils.escape("table")); + Assertions.assertEquals("", LibSqlUtils.escape("")); + + // Every single quote must be doubled, wherever it sits. + Assertions.assertEquals("''", LibSqlUtils.escape("'")); + Assertions.assertEquals("a''b", LibSqlUtils.escape("a'b")); + Assertions.assertEquals("''ab", LibSqlUtils.escape("'ab")); + Assertions.assertEquals("ab''", LibSqlUtils.escape("ab'")); + + // Regression: a quote at index 1 used to be returned un-escaped + // (guard was `== 1` instead of `== -1`), letting the quote close the + // surrounding SQL string literal in concatenated metadata queries. + Assertions.assertEquals("x''", LibSqlUtils.escape("x'")); + Assertions.assertEquals("x'' OR ''1''=''1", LibSqlUtils.escape("x' OR '1'='1")); + } } \ No newline at end of file