fix(sql): escape single quotes in COMMENT text - #2431
Merged
openai0229 merged 3 commits intoAug 3, 2026
Merged
Conversation
COMMENT text was interpolated raw between single quotes, so a comment containing an apostrophe (e.g. employee's id) produced malformed DDL the DB rejected, and a crafted comment could break out of the literal. Double embedded single quotes (SQL-standard) at the four comment sites, with null guards. Backslash is intentionally not doubled (matching current behavior) to avoid corrupting comments on standard-conforming dialects. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: liuhy <liuhongyu@apache.org>
There was a problem hiding this comment.
Pull request overview
This PR hardens DDL generation in the SPI layer by SQL-standard escaping of single quotes inside COMMENT literals, preventing malformed DDL when comments contain apostrophes and reducing literal-breakout (injection) risk.
Findings (need attention):
chat2db-community-server/chat2db-community-spi/.../DBStructUtils.java:144-146:generateTableCommentSQLemitsIS ''whencomment == null, which sets an empty-string comment rather than removing the comment (standard removal isIS NULLfor COMMENT statements on PostgreSQL/Oracle-style dialects).
Changes:
- Escape
'as''for MySQL-style inline columnCOMMENT '...'in create-table SQL generation. - Escape
'as''forCOMMENT ON COLUMN ... IS '...'. - Escape
'as''forCOMMENT ON TABLE ... IS '...', with a null guard.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| chat2db-community-server/chat2db-community-spi/src/main/java/ai/chat2db/spi/util/DBStructUtils.java | Escapes single quotes in generated column/table comment DDL; adjusts null handling for table comments (currently to empty string). |
| chat2db-community-server/chat2db-community-spi/src/main/java/ai/chat2db/spi/DefaultSqlBuilder.java | Escapes single quotes in COMMENT ON COLUMN ... IS '...' generation used by the default DDL table builder. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
openai0229
approved these changes
Aug 3, 2026
openai0229
left a comment
Contributor
There was a problem hiding this comment.
Reviewed after correcting null comment removal and adding regression coverage for apostrophes and backslashes. All 16 targeted SPI tests pass locally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
COMMENT text was interpolated directly between single quotes, so apostrophes produced malformed DDL and could break out of the literal. Table-comment removal also needs SQL
NULL, not an empty-string literal.Fix
DBStructUtilscomment literals.COMMENT ON TABLE ... IS NULLwhen removing a table comment.Verification
DefaultSqlBuilderSegmentTest: 8 passedDBStructUtilsTest: 8 passedFixes #2430