fix(dm): escape SQL identifiers and literals in metadata/DDL paths (#1914) - #2198

Merged

openai0229 merged 6 commits into

OtterMind:mainfrom

HandSonic:fix/sqli2-dm

Jul 29, 2026

Commits on Jul 29, 2026

fix(dm): escape SQL identifiers and literals in metadata/DDL paths (#1914)

HandSonic
authored and
openai0229
committed
7a18701
refactor(dm): move escaping into DMIdentifierProcessor per maintainer review (#1914)

HandSonic
authored and
openai0229
committed
4d5a318
fix(dm): keep SPI quoteIdentifier conditional, reserve always-quote for DDL paths (#1914)

HandSonic
authored and
openai0229
committed
91e8671
fix(dm): unroll quoted-literal regex to avoid CodeQL polynomial-regex alert (#1914)

HandSonic
authored and
openai0229
committed
24228a4
fix(dm): replace DEFAULT validator regex with linear scanners (CodeQL ReDoS) (#1914)

HandSonic
authored and
openai0229
committed
88984b4
fix(dm): complete identifier-safe SQL generation
openai0229
committed
b490b5b