Properly escape table names in model fetch

...

Author: helje5

Sources/ZeeQL/SQLite3Adaptor/SQLite3ModelFetch.swift

@@ -65,12 +65,19 @@ open class SQLite3ModelFetch: AdaptorModelFetch {
     // TBD: iterate on all returned describeDatabaseNames
     // (via dbname.sqlite_master)
     // ATTACH DATABASE 'DatabaseName' As 'Alias-Name';
-    var sql = "SELECT name FROM sqlite_master WHERE type IN ('table', 'view')"
-    if let like = like {
-      sql += " AND name LIKE '" + like + "'"; // TODO: escape!
-    }
     var names = [ String ]()
-    try channel.select(sql) { ( name : String ) in names.append(name) }
+    let expression = channel.expressionFactory.createExpression(nil)
+    expression.statement =
+      "SELECT name FROM sqlite_master WHERE type IN ('table', 'view')"
+    if let like {
+      expression.statement += " AND name LIKE ?"
+      expression.bindVariables = [
+        SQLExpression.BindVariable(attribute: nil, value: like)
+      ]
+    }
+    try channel.evaluateQueryExpression(expression, nil) { record in
+      if let name = record[0] as? String { names.append(name) }
+    }
     return names
   }
 
@@ -89,17 +96,22 @@ open class SQLite3ModelFetch: AdaptorModelFetch {
 
   func _fetchColumnsOfTable(_ table: String) throws -> [ AdaptorRecord ] {
     // keys: cid, name, type, notnull, dflt_value, pk
-    let records : [ AdaptorRecord ] =
-                      try channel.querySQL("PRAGMA table_info(\(table))")
+    let table = quotedIdentifier(table)
+    let records = try channel.querySQL("PRAGMA table_info(\(table))")
     return records
   }
 
   func _fetchForeignKeysOfTable(_ table: String) throws -> [ AdaptorRecord ] {
     // keys: id, seq, table, from, to, on_update, on_delete, match
-    let records : [ AdaptorRecord ] =
-                      try channel.querySQL("PRAGMA foreign_key_list(\(table))")
+    let table = quotedIdentifier(table)
+    let records = try channel.querySQL("PRAGMA foreign_key_list(\(table))")
     return records
   }
+
+  private func quotedIdentifier(_ identifier: String) -> String {
+    return channel.expressionFactory.createExpression(nil)
+                  .sqlStringFor(schemaObjectName: identifier)
+  }
 
   func primaryKeyNamesFromColumnInfos(_ columnInfos : [ AdaptorRecord ],
                                       _ attributes  : [ Attribute ])

Tests/ZeeQLTests/SQLite3ModelTests.swift

@@ -97,6 +97,39 @@ class SQLite3ModelTests: XCTestCase {
     XCTAssert(!tag4.isEqual(to: tag6))
     XCTAssert(!tag1.isEqual(to: tag6))
   }
+
+  func testDescribeTableNamesBindsLikePattern() throws {
+    let channel = try SQLite3Adaptor(":memory:").openChannel()
+    try channel.performSQL("CREATE TABLE normal(id INTEGER)")
+    try channel.performSQL("CREATE TABLE \"odd'name\"(id INTEGER)")
+    let fetch = SQLite3ModelFetch(channel: channel)
+
+    XCTAssertEqual(try fetch.describeTableNames(like: "odd'%"),
+                   [ "odd'name" ])
+    XCTAssertTrue(
+      try fetch.describeTableNames(like: "%' OR 1=1 --").isEmpty)
+  }
+
+  func testDescribeEntityQuotesTableName() throws {
+    let channel = try SQLite3Adaptor(":memory:").openChannel()
+    try channel.performSQL(
+      "CREATE TABLE \"parent table\"(\"id\" INTEGER PRIMARY KEY)")
+    try channel.performSQL(
+      """
+      CREATE TABLE "child)""table"(
+        "parent id" INTEGER,
+        FOREIGN KEY("parent id") REFERENCES "parent table"("id"))
+      """)
+    let fetch = SQLite3ModelFetch(channel: channel)
+
+    let entity = try fetch.describeEntityWithTableName("child)\"table")
+    XCTAssertEqual(entity.externalName, "child)\"table")
+    XCTAssertNotNil(entity[attribute: "parent id"])
+    XCTAssertEqual(entity.relationships.count, 1)
+    let relationship = try XCTUnwrap(
+      entity.relationships[0] as? ModelRelationship)
+    XCTAssertEqual(relationship.destinationEntityName, "parent table")
+  }
 
 
   // MARK: - Non-ObjC Swift Support
@@ -106,5 +139,9 @@ class SQLite3ModelTests: XCTestCase {
     ( "testDescribeOGoTableNames", testDescribeOGoTableNames ),
     ( "testFetchModel",            testFetchModel ),
     ( "testSchemaTag",             testSchemaTag  ),
+    ( "testDescribeTableNamesBindsLikePattern",
+      testDescribeTableNamesBindsLikePattern ),
+    ( "testDescribeEntityQuotesTableName",
+      testDescribeEntityQuotesTableName ),
   ]
 }