Skip to content

fix(oceanbase-oracle): escape SQL identifiers and literals in metadata/DDL paths (#1914) - #2205

Merged
openai0229 merged 5 commits into
OtterMind:mainfrom
HandSonic:fix/sqli2-oceanbase-oracle
Jul 29, 2026
Merged

fix(oceanbase-oracle): escape SQL identifiers and literals in metadata/DDL paths (#1914)#2205
openai0229 merged 5 commits into
OtterMind:mainfrom
HandSonic:fix/sqli2-oceanbase-oracle

Conversation

@HandSonic

@HandSonic HandSonic commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Related issue

Closes #1914

Summary

  • Escape OceanBase Oracle metadata lookup arguments as Oracle string-literal content before interpolation into DBMS_METADATA and catalog queries.
  • Expose an OceanBase Oracle identifier processor through the SPI while inheriting Oracle's conditional quoting, case-folding, reserved-word, literal, and exact always-quote round-trip contracts.
  • Replace the parallel SqlUtils.quoteObjectName path in generated table and column comments with full dialect identifier tokens.
  • Cover metadata query generation, embedded literal quotes, conditional versus always-quote behavior, boundary delimiters, and exact quote/remove round trips.

Affected surfaces

  • Frontend / Web
  • Backend / API / Storage
  • Database plugin / Driver
  • JCEF / Desktop packaging
  • CI / Build / Release
  • Documentation only

Verification

  • Commands and results:
    • mvn -f chat2db-community-server/pom.xml -pl chat2db-community-plugins/chat2db-community-oceanbase-oracle -am clean test -DskipTests=false -Dmaven.test.skip=false
    • Result: 9-module reactor BUILD SUCCESS; tools 26/26, SPI 90/90, Oracle 44/44, OceanBase Oracle 12/12; zero failures, errors, or skipped tests in these modules.
    • git diff --check origin/main...HEAD
    • Result: passed with no whitespace errors.
  • Manual verification: N/A; metadata and identifier generation are covered by executable tests and no OceanBase Oracle instance is available in this environment.
  • UI evidence: N/A

Risk and compatibility

  • Public API or stored data: No endpoint, DTO, or stored-data migration changes; the plugin uses the existing identifier processor SPI.
  • Database or driver compatibility: OceanBase Oracle mode retains Oracle identifier case and reserved-word behavior. Catalog calls preserve normal names while doubling embedded single quotes.
  • Network, privacy, or security: Reduces metadata-query and reconstructed-DDL breakout risk. No network or privacy behavior changes.
  • Community / Local / Pro boundary: Community OceanBase Oracle plugin only; other products inherit it only when built with this Community plugin.
  • Backward compatibility: Normal schema, table, column, and index names produce the same logical queries and DDL. Names requiring Oracle quoting now remain inside one valid token.

Reviewer map

  • Start here: chat2db-community-server/chat2db-community-plugins/chat2db-community-oceanbase-oracle/src/main/java/ai/chat2db/plugin/oceanbase/oracle/OceanbaseOracleMetaData.java, then identifier/OceanbaseOracleIdentifierProcessor.java and OceanbaseOracleIdentifierProcessorTest.java.
  • Failure condition: Any catalog argument can terminate its string literal, comment DDL can break its identifier token, OceanBase diverges from Oracle case rules, or always-quote fails exact round-trip.
  • Rollback or disable path: Revert this PR. There is no feature flag or data migration.

Contributor declaration

  • I linked the Issue that defines this change.
  • I tested the affected behavior and reported the actual results above.
  • I did not include credentials, private data, or generated build output.
  • I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: Maintainer used AI-assisted code review and test development; all resulting changes were source-reviewed and verified with the clean Maven reactor reported above.

HandSonic and others added 5 commits July 29, 2026 20:47
…ierProcessor per maintainer review (OtterMind#1914)

- new OceanbaseOracleIdentifierProcessor (SPI ISQLIdentifierProcessor):
  quoteIdentifier with double-quote doubling, escapeString with
  single-quote doubling
- OceanbaseOracleMetaData overrides getSQLIdentifierProcessor(); DDL
  builder helpers use OceanbaseOracleIdentifierProcessor.INSTANCE
- OceanbaseOracleSqlEscapes removed; tests migrated (5 green)
…always-quote for DDL paths (OtterMind#1914)

- quoteIdentifier(String) is conditional again: null/blank passthrough,
  plain non-reserved identifiers returned unquoted (fixes
  GenericSqlCompletionEngine raw-vs-quoted mismatches); other inputs are
  double-quote wrapped with embedded-quote doubling
- new quoteIdentifierAlways(String) for DDL-generation call sites that
  require unconditional quoting; quoteIdentifierIgnoreCase is the
  always-quote SPI variant and delegates to it
- processor now extends OracleIdentifierProcessor to inherit the Oracle
  reserved-keyword set; versioned overload delegates to
  quoteIdentifier(String)
- tests cover conditional and always behaviors incl. null passthrough
  (10 green)
@openai0229
openai0229 force-pushed the fix/sqli2-oceanbase-oracle branch from ba65b8b to 75f2ece Compare July 29, 2026 12:48

@openai0229 openai0229 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rebased on the latest main and verified Oracle-compatible identifier semantics, exact quote/remove round trips, metadata literal escaping, and generated comment identifiers. The clean 9-module reactor passes with OceanBase Oracle 12/12, Oracle 44/44, SPI 90/90, and tools 26/26.

@openai0229
openai0229 merged commit cfc4c04 into OtterMind:main Jul 29, 2026
19 checks passed
@openai0229 openai0229 moved this from In Review to Done in Chat2DB Community Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

Security: 34 SQL Injection Vulnerabilities in Database Plugins

2 participants