fix(clickhouse): escape SQL identifiers and literals in metadata/DDL paths (#1914)

[HandSonic]

Related issue

Part of the SQL-injection hardening tracked in #1914 (multi-plugin effort; this PR covers ClickHouse). Prior art: #2052 (Oracle escapeSqlLiteral), #2053 (SQL Server identifier quoting).

Summary

These are second-order injection paths: values such as table/schema/view/index names originate from the connected database's own metadata, so exploitation requires a maliciously named object in a target database. The fix is still worthwhile hardening and matches the pattern already merged for Oracle and SQL Server.

What changed:

• New ClickHouseSqlEscapes helper:
  • escapeSqlLiteral — doubles backslashes first, then single quotes (ClickHouse treats backslash as an escape character inside string literals).
  • quoteIdentifier/escapeIdentifier — strips one surrounding backtick pair and doubles every embedded backtick for quoted-identifier positions.
• Applied across metadata/DDL SQL-building sites in 9 files (see diff; pom change is test-scope JUnit only). The naive format() helper was fixed at the source, so all callers now get backtick doubling.
• ENGINE clause and DEFAULT expressions are guarded by strict whitelist/regex validation; ) is forbidden inside the parenthesized argument to block paren-breakout (e.g. Memory() ORDER BY tuple() -- x).
• Quoted string DEFAULT literals (e.g. 'abc') remain supported: the inner content is escaped with escapeSqlLiteral before re-quoting, so 'a');DROP TABLE t;--' is emitted as a harmless literal.
• Column types outside the enum are handled fail-closed: requireColumnTypeExpression validates the declared type shape (letters/digits/underscore; spaces, commas, quotes and = — for Enum8('a'=1) — only inside balanced parentheses) instead of emitting it verbatim. The fallback path keeps Nullable(...) wrapping and DEFAULT handling (validated) so unknown-type columns no longer lose them. getByType no longer strips digits (which broke Int32/Int64 resolution); it trims and cuts at ( before the map lookup.
• exportFunctionDdl now quotes the function name in DROP FUNCTION IF EXISTS; buildCreateDatabase quotes the database name via the helper.
• Added ClickHouseSqlEscapesTest covering backslash+quote literal doubling, backtick identifier doubling, malicious-name neutralization, engine/default paren-breakout rejection, quoted string defaults, mixed-case/digit type resolution, and unknown-type fallback validation.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Command: mvn -B -pl chat2db-community-plugins/chat2db-community-clickhouse -f chat2db-community-server/pom.xml -Dmaven.test.skip=false -DskipTests=false -Dsurefire.failIfNoSpecifiedTests=false -Dmaven.test.failure.ignore=false clean test
• Result: Tests run: 24, Failures: 0, Errors: 0, Skipped: 0 (includes pre-existing module tests).
• Manual verification: escaping is identity for names without special characters; a name containing a backtick is emitted doubled inside a backtick-quoted identifier; invalid ENGINE/DEFAULT/column-type expressions are rejected with IllegalArgumentException.

Risk and compatibility

• Public API or stored data: N/A — only changes generated SQL for metadata/DDL paths.
• Database or driver compatibility: quoted output matches ClickHouse backtick identifier and backslash-aware literal rules; behavior for ordinary names is unchanged.
• Network, privacy, or security: closes second-order SQL-injection paths in generated metadata/DDL SQL.
• Community / Local / Pro boundary: N/A.
• Backward compatibility: names containing backticks that previously produced broken/injectable SQL now produce correctly escaped SQL; invalid ENGINE/DEFAULT/column-type expressions are now rejected instead of emitted verbatim. Plain quoted string defaults (e.g. 'abc') continue to work.

Reviewer map

• Start here: ClickHouseSqlEscapes.java (new helper, incl. requireColumnTypeExpression) and ClickHouseSqlEscapesTest.java.
• Then: the fixed format() helper and its callers; validateEngine/validateDefaultExpression; ClickHouseColumnTypeEnum.getByType/buildCreateColumnSqlSafely; exportFunctionDdl in ClickHouseDBManager.
• Failure condition: a metadata/DDL SQL string still interpolates an unescaped name or literal.
• Rollback or disable path: revert the commit on this branch.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: The fix, verification, and PR description were produced with AI coding assistance.

[HandSonic]

Converting to draft: final adversarial review pass is still in progress for this branch. Will mark ready for review once it completes. (process note: PR was opened prematurely by automation)