From 0ba33a6e0227d20840b2d083fc6bc256359ba4fd Mon Sep 17 00:00:00 2001 From: Vladimir Babin Date: Tue, 3 Nov 2026 19:06:28 +0800 Subject: [PATCH] dbeaver/dbeaver-jdbc-libsql#68 fix(libsql): correct escape() no-quote guard (was == 1, should be == -1) LibSqlUtils.escape() doubles single quotes for values embedded in concatenated metadata SQL (pragma index_list/index_info/foreign_key_list and related DatabaseMetaData queries). The early-return guard read `indexOf('\'') == 1` instead of `== -1`, so any value whose first single quote is at index 1 (e.g. `x'`) was returned un-escaped, letting the quote close the surrounding string literal. Change the guard to `== -1` (return unchanged only when no quote is present) and add LibSqlUtilsTest#testEscape covering quotes at the start, middle, end, and the index-1 regression case. --- .../jdbc/driver/libsql/LibSqlUtils.java | 2 +- .../jdbc/upd/driver/test/LibSqlUtilsTest.java | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/com.dbeaver.jdbc.driver.libsql/src/main/java/com/dbeaver/jdbc/driver/libsql/LibSqlUtils.java b/com.dbeaver.jdbc.driver.libsql/src/main/java/com/dbeaver/jdbc/driver/libsql/LibSqlUtils.java index 4bcc5e3..240de29 100644 --- a/com.dbeaver.jdbc.driver.libsql/src/main/java/com/dbeaver/jdbc/driver/libsql/LibSqlUtils.java +++ b/com.dbeaver.jdbc.driver.libsql/src/main/java/com/dbeaver/jdbc/driver/libsql/LibSqlUtils.java @@ -50,7 +50,7 @@ public static String unquote(String name) { } public static String escape(final String val) { - if (val.indexOf('\'') == 1) { + if (val.indexOf('\'') == -1) { return val; } int len = val.length(); diff --git a/com.dbeaver.jdbc.driver.libsql/src/test/java/com/dbeaver/jdbc/upd/driver/test/LibSqlUtilsTest.java b/com.dbeaver.jdbc.driver.libsql/src/test/java/com/dbeaver/jdbc/upd/driver/test/LibSqlUtilsTest.java index 46f7233..239d23e 100644 --- a/com.dbeaver.jdbc.driver.libsql/src/test/java/com/dbeaver/jdbc/upd/driver/test/LibSqlUtilsTest.java +++ b/com.dbeaver.jdbc.driver.libsql/src/test/java/com/dbeaver/jdbc/upd/driver/test/LibSqlUtilsTest.java @@ -45,4 +45,23 @@ public void testFormatUrl() throws LibSqlException { private void assertUrlFormat(String input, String expected) throws LibSqlException { Assertions.assertEquals(expected, LibSqlUtils.validateAndFormatUrl(input)); } + + @Test + public void testEscape() { + // No quote: returned unchanged. + Assertions.assertEquals("table", LibSqlUtils.escape("table")); + Assertions.assertEquals("", LibSqlUtils.escape("")); + + // Every single quote must be doubled, wherever it sits. + Assertions.assertEquals("''", LibSqlUtils.escape("'")); + Assertions.assertEquals("a''b", LibSqlUtils.escape("a'b")); + Assertions.assertEquals("''ab", LibSqlUtils.escape("'ab")); + Assertions.assertEquals("ab''", LibSqlUtils.escape("ab'")); + + // Regression: a quote at index 1 used to be returned un-escaped + // (guard was `== 1` instead of `== -1`), letting the quote close the + // surrounding SQL string literal in concatenated metadata queries. + Assertions.assertEquals("x''", LibSqlUtils.escape("x'")); + Assertions.assertEquals("x'' OR ''1''=''1", LibSqlUtils.escape("x' OR '1'='1")); + } } \ No newline at end of file