fix(dm): escape SQL identifiers and literals in metadata/DDL paths (#1914) - #2198
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
4 tasks
… review (OtterMind#1914) - strengthen DMIdentifierProcessor (SPI ISQLIdentifierProcessor): always-quote quoteIdentifier with embedded-quote doubling, escapeString with single-quote doubling, static escapeIdentifier for pre-quoted templates, INSTANCE - DMMetaData.getSQLIdentifierProcessor() returns the shared INSTANCE; metadata call sites use it (quoteIdentifier / escapeString / method refs) - builders/DBManager/enums use DMIdentifierProcessor.INSTANCE / static escapeIdentifier - non-escapable DEFAULT-expression validation moved to public DMSqlGuards - DMSqlEscapes removed; tests migrated to DMIdentifierProcessorTest (11 green)
… ReDoS) (OtterMind#1914) Balanced-paren + quoted-literal aware scanning keeps NVL(SUM(x),0) and quoted defaults accepted; semicolons and unbalanced input rejected.
openai0229
approved these changes
Jul 29, 2026
openai0229
left a comment
openai0229
left a comment
Contributor
There was a problem hiding this comment.
Rebased on the latest main and verified the complete DM identifier/literal handling path. The clean 9-module reactor passes, including DM 24/24, Oracle 44/44, SPI 90/90, and tools 26/26.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue
Closes #1914
Summary
Completes the DM database-plugin portion of the identifier and literal escaping work.
DMIdentifierProcessor, including embedded delimiter escaping and exact quote/remove round trips.Affected surfaces
Verification
mvn -pl chat2db-community-plugins/chat2db-community-dm -am clean test -Dmaven.test.skip=false -DskipTests=falseBUILD SUCCESSacross 9 reactor modules; 184 tests passed in tested modules, including DM24/24, Oracle44/44, SPI90/90, and tools26/26.git diff --check origin/main...HEAD: passed.Risk and compatibility
ISQLIdentifierProcessorcontract.Reviewer map
DMIdentifierProcessor,DMSqlGuards, andDMIdentifierProcessorTest, then review call sites inDMMetaData,DMDBManager, andDMSqlBuilder.Contributor declaration
AI assistance: Substantial AI-assisted maintainer revision and test expansion; all final changes were source-reviewed and verified with the commands above.