Skip to content

SYM-7855: Sanitize object identifiers in SQL commands #1004

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Andrew Webb (w3bbd3v-jm) merged 6 commits into from
Aug 20, 2026
Merged

SYM-7855: Sanitize object identifiers in SQL commands #1004

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3f7f806
SYM-7855: sanitize sql.
w3bbd3v-jm Aug 18, 2026
7f570af
Merge branch 'release/3.18' into fix/SYM-7855_sanitize_sql
w3bbd3v-jm Aug 19, 2026
c3037cb
SYM-7855: switch to use sanitizeFunction instead of sanitizeIdentifier.
w3bbd3v-jm Aug 19, 2026
8b804bd
Merge branch 'fix/SYM-7855_sanitize_sql' of https://github.com/jumpmi…
w3bbd3v-jm Aug 19, 2026
d774979
Merge branch 'release/3.18' into fix/SYM-7855_sanitize_sql
w3bbd3v-jm Aug 19, 2026
6702ee4
Merge branch 'release/3.18' into fix/SYM-7855_sanitize_sql
w3bbd3v-jm Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions symmetric-client/src/main/java/org/jumpmind/symmetric/db/AbstractEmbeddedTrigger.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@
import org.apache.commons.lang3.time.FastDateFormat;
import org.h2.jdbc.JdbcBlob;
import org.h2.jdbc.JdbcClob;
import org.jumpmind.db.sql.SqlUtils;
import org.jumpmind.symmetric.db.h2.H2Trigger;
import org.jumpmind.symmetric.db.hsqldb.HsqlDbTrigger;

Expand Down Expand Up @@ -286,8 +287,9 @@
protected Map<String, String> getTemplates(Connection conn) throws SQLException {
Map<String, String> templates = new HashMap<String, String>();
try (Statement stmt = conn.createStatement()) {
String schemaPrefix = schemaName != null && schemaName.length() > 0 ? "\"" + schemaName + "\"." : "";
ResultSet rs = stmt.executeQuery(String.format("select * from %s%s%s", schemaPrefix, triggerName, TEMPLATE_TABLE_SUFFIX));
String schemaPrefix = schemaName != null && schemaName.length() > 0 ? "\"" + SqlUtils.sanitizeIdentifier(schemaName) + "\"." : "";

Check warning on line 290 in symmetric-client/src/main/java/org/jumpmind/symmetric/db/AbstractEmbeddedTrigger.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use "isEmpty()" to check whether a "String" is empty or not. 


See more on https://sonarcloud.io/project/issues?id=jumpmindinc_symmetric-ds&issues=AaAWtOaDdxjKDOyczlZv&open=AaAWtOaDdxjKDOyczlZv&pullRequest=1004
ResultSet rs = stmt.executeQuery(String.format("select * from %s%s%s", schemaPrefix, SqlUtils.sanitizeIdentifier(triggerName),
TEMPLATE_TABLE_SUFFIX));

Check warning on line 292 in symmetric-client/src/main/java/org/jumpmind/symmetric/db/AbstractEmbeddedTrigger.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Make sure using a dynamically formatted SQL query is safe here. 


See more on https://sonarcloud.io/project/issues?id=jumpmindinc_symmetric-ds&issues=AaAWtOaDdxjKDOyczlZw&open=AaAWtOaDdxjKDOyczlZw&pullRequest=1004
if (rs.next()) {
ResultSetMetaData metaData = rs.getMetaData();
int columnCount = metaData.getColumnCount();
Expand Down
5 changes: 3 additions & 2 deletions symmetric-client/src/main/java/org/jumpmind/symmetric/db/ase/AseSymmetricDialect.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@
import org.jumpmind.db.sql.JdbcSqlTemplate;
import org.jumpmind.db.sql.JdbcSqlTransaction;
import org.jumpmind.db.sql.SqlException;
import org.jumpmind.db.sql.SqlUtils;
import org.jumpmind.db.util.BinaryEncoding;
import org.jumpmind.symmetric.SymmetricException;
import org.jumpmind.symmetric.common.ParameterConstants;
Expand Down Expand Up @@ -197,8 +198,8 @@ public void dropRequiredDatabaseObjects() {
@Override
public void removeTrigger(StringBuilder sqlBuffer, final String catalogName, String schemaName,
final String triggerName, String tableName, ISqlTransaction transaction) {
schemaName = schemaName == null ? "" : (schemaName + ".");
final String sql = "drop trigger " + schemaName + triggerName;
schemaName = schemaName == null ? "" : (SqlUtils.sanitizeIdentifier(schemaName) + ".");
final String sql = "drop trigger " + schemaName + SqlUtils.sanitizeIdentifier(triggerName);
logSql(sql, sqlBuffer);
if (parameterService.is(ParameterConstants.AUTO_SYNC_TRIGGERS) && sqlBuffer == null) {
if (log.isInfoEnabled()) {
Expand Down
3 changes: 2 additions & 1 deletion ...etric-jdbc/src/main/java/org/jumpmind/db/platform/greenplum/GreenplumJdbcSqlTemplate.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
import org.jumpmind.db.platform.DatabaseInfo;
import org.jumpmind.db.platform.postgresql.PostgreSqlJdbcSqlTemplate;
import org.jumpmind.db.sql.SqlTemplateSettings;
import org.jumpmind.db.sql.SqlUtils;
import org.jumpmind.db.sql.SymmetricLobHandler;

public class GreenplumJdbcSqlTemplate extends PostgreSqlJdbcSqlTemplate {
Expand All @@ -54,7 +55,7 @@
ResultSet rs = null;
try {
st = conn.createStatement();
rs = st.executeQuery("select nextval('" + sequenceName + "_seq')");
Comment thread
w3bbd3v-jm marked this conversation as resolved.
rs = st.executeQuery("select nextval('" + SqlUtils.sanitizeFunction(sequenceName) + "_seq')");

Check warning on line 58 in symmetric-jdbc/src/main/java/org/jumpmind/db/platform/greenplum/GreenplumJdbcSqlTemplate.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Make sure using a dynamically formatted SQL query is safe here. 


See more on https://sonarcloud.io/project/issues?id=jumpmindinc_symmetric-ds&issues=AaAWtOhmdxjKDOyczlZx&open=AaAWtOhmdxjKDOyczlZx&pullRequest=1004
if (rs.next()) {
key = rs.getLong(1);
}
Expand Down
4 changes: 2 additions & 2 deletions symmetric-jdbc/src/main/java/org/jumpmind/db/sql/JdbcSqlTemplate.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -872,7 +872,7 @@
if (supportsGetGeneratedKeys) {
ps = conn.prepareStatement(sql, new int[] { 1 });
} else if (supportsReturningKeys) {
ps = conn.prepareStatement(sql + " returning " + column);
ps = conn.prepareStatement(sql + " returning " + SqlUtils.sanitizeIdentifier(column));

Check warning on line 875 in symmetric-jdbc/src/main/java/org/jumpmind/db/sql/JdbcSqlTemplate.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Make sure using a dynamically formatted SQL query is safe here. 


See more on https://sonarcloud.io/project/issues?id=jumpmindinc_symmetric-ds&issues=AaAWtOikdxjKDOyczlZy&open=AaAWtOikdxjKDOyczlZy&pullRequest=1004
} else {
ps = conn.prepareStatement(sql);
}
Expand Down Expand Up @@ -912,7 +912,7 @@
ps.execute();
try {
st = conn.createStatement();
rs = st.executeQuery(getSelectLastInsertIdSql(sequenceName));
rs = st.executeQuery(getSelectLastInsertIdSql(SqlUtils.sanitizeIdentifier(sequenceName)));
if (rs.next()) {
key = rs.getLong(1);
}
Expand Down
Loading