fix(xugudb): escape SQL identifiers and literals in metadata/DDL paths (#1914) - #2175

Merged

openai0229 merged 8 commits into

OtterMind:mainfrom

HandSonic:fix/sqli-xugudb

Jul 29, 2026

Commits on Jul 29, 2026

fix(xugudb): escape SQL identifiers and literals in metadata/DDL paths (#1914)

HandSonic
authored and
openai0229
committed
fix(xugudb): quote identifiers in select/insert builders and harden column fallback (#1914)

HandSonic
authored and
openai0229
committed
fix(xugudb): tighten function-default pattern validation + round-trip tests (#1914)

HandSonic
authored and
openai0229
committed
refactor(xugudb): move escaping into XugudbIdentifierProcessor per maintainer review (#1914)

HandSonic
authored and
openai0229
committed
fix(xugudb): unroll quoted-literal regex to avoid CodeQL polynomial-regex alert (#1914)

HandSonic
authored and
openai0229
committed
fix(xugudb): replace DEFAULT validator regex with linear scanners (CodeQL ReDoS) (#1914)

HandSonic
authored and
openai0229
committed
fix(xugudb): restore dual-track quoteIdentifier contract (null passthrough, conditional for SPI, always for DDL) (#1914)

HandSonic
authored and
openai0229
committed
fix(xugudb): complete identifier escaping coverage
openai0229
committed