Skip to content

fix(oracle): escape SQL identifiers and literals in metadata/DDL paths (#1914) - #2195

Merged
openai0229 merged 4 commits into
OtterMind:mainfrom
HandSonic:fix/sqli2-oracle
Jul 29, 2026
Merged

fix(oracle): escape SQL identifiers and literals in metadata/DDL paths (#1914)#2195
openai0229 merged 4 commits into
OtterMind:mainfrom
HandSonic:fix/sqli2-oracle

Conversation

@HandSonic

@HandSonic HandSonic commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Related issue

Closes #1914

Summary

Completes the Oracle database-plugin portion of the identifier and literal escaping work.

  • Routes Oracle metadata, DB manager, SQL builder, type/index rendering, and DML value processors through one Oracle identifier/literal contract.
  • Preserves conditional quoteIdentifier(...) behavior for completion and lookup while using quoteIdentifierAlways(...) at generated-DDL sites.
  • Round-trips embedded double quotes and existing outer quotes without losing identifier text.
  • Adds quote-aware validation for Oracle type/default expressions so legal expressions such as functions, casts, sequences, intervals, and nested calls are preserved while unbalanced or multi-statement fragments are rejected.
  • Adds focused processor, guard, builder, metadata, and value-serialization coverage.

Affected surfaces

  • Frontend / Web
  • Backend / API / Storage
  • Database plugin / Driver
  • JCEF / Desktop packaging
  • CI / Build / Release
  • Documentation only

Verification

  • Commands and results:
    • mvn -B -f chat2db-community-server/pom.xml -pl chat2db-community-plugins/chat2db-community-oracle -am clean test -DskipTests=false -Dmaven.test.skip=false -Dsurefire.failIfNoSpecifiedTests=false
    • Result: BUILD SUCCESS across 8 reactor modules; 160 tests passed in tested modules, including Oracle 44/44, SPI 90/90, and tools 26/26.
    • git diff --check origin/main...HEAD: passed.
  • Manual verification: Source-level generated-SQL review completed. No live Oracle instance was used.
  • UI evidence: N/A

Risk and compatibility

  • Public API or stored data: No public API or stored-data schema change. Uses the existing shared ISQLIdentifierProcessor contract.
  • Database or driver compatibility: Oracle identifier case behavior remains conditional for lookup/completion; generated DDL now quotes identifiers consistently. Legal Oracle default/type expressions covered by regression tests.
  • Network, privacy, or security: No network or privacy change. Reduces malformed SQL and identifier/literal injection risk in metadata-driven DDL/export paths.
  • Community / Local / Pro boundary: Community Oracle plugin only; Local and Pro consume the Community plugin behavior without product-specific code changes.
  • Backward compatibility: Existing ordinary identifiers and values retain their emitted form; embedded delimiters and quoted names now round-trip correctly.

Reviewer map

  • Start here: OracleIdentifierProcessor, OracleSqlGuards, then OracleSqlBuilder and OracleMetaData.
  • Failure condition: Identifier text changes after quote/remove round-trip, legal Oracle defaults/types are rewritten, or generated SQL contains raw metadata identifiers/literals.
  • Rollback or disable path: Revert this PR; no migration or persisted-data rollback is required.

Contributor declaration

  • I linked the Issue that defines this change.
  • I tested the affected behavior and reported the actual results above.
  • I did not include credentials, private data, or generated build output.
  • I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: Substantial AI-assisted maintainer revision, review, and test expansion; all final changes were source-reviewed and verified with the commands above.

HandSonic and others added 4 commits July 29, 2026 15:57
…intainer review (OtterMind#1914)

- strengthen OracleIdentifierProcessor: INSTANCE, escapeString with
  single-quote doubling, static escapeIdentifier/quoteIdentifierAlways
- OracleMetaData processor singleton delegates to INSTANCE; private
  escapeSqlLiteral (OtterMind#2052) unified to processor escapeString
- builders/DBManager/enums/value processors use the processor (or
  OracleSqlGuards for non-escapable validation)
- OracleSqlEscapes removed; tests migrated (33 green)

@openai0229 openai0229 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maintainer review complete. Rebased onto current main, preserved Oracle identifier/literal semantics, and verified with the eight-module clean reactor test suite (160/160 tests passed).

@openai0229
openai0229 merged commit 4eb7cf5 into OtterMind:main Jul 29, 2026
21 checks passed
@openai0229 openai0229 moved this from In Review to Done in Chat2DB Community Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

Security: 34 SQL Injection Vulnerabilities in Database Plugins

2 participants