Skip to content

fix(sql): escape single quotes in COMMENT text - #2431

Merged
openai0229 merged 3 commits into
OtterMind:mainfrom
Aias00:fix/comment-single-quote-escape-2430
Aug 3, 2026
Merged

openai0229 merged 3 commits into
OtterMind:mainfrom
Aias00:fix/comment-single-quote-escape-2430

Conversation

@Aias00

@Aias00 Aias00 commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

What

COMMENT text was interpolated directly between single quotes, so apostrophes produced malformed DDL and could break out of the literal. Table-comment removal also needs SQL NULL, not an empty-string literal.

Fix

  • Double embedded single quotes in default builder and DBStructUtils comment literals.
  • Preserve backslashes unchanged for standard-conforming dialects.
  • Emit COMMENT ON TABLE ... IS NULL when removing a table comment.
  • Add regression coverage for inline column comments, default-builder column comments, table comments, backslashes, and null removal.

Verification

  • DefaultSqlBuilderSegmentTest: 8 passed
  • DBStructUtilsTest: 8 passed
  • Targeted SPI reactor build: success

Fixes #2430

COMMENT text was interpolated raw between single quotes, so a comment
containing an apostrophe (e.g. employee's id) produced malformed DDL the
DB rejected, and a crafted comment could break out of the literal. Double
embedded single quotes (SQL-standard) at the four comment sites, with null
guards. Backslash is intentionally not doubled (matching current behavior)
to avoid corrupting comments on standard-conforming dialects.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: liuhy <liuhongyu@apache.org>
Copilot AI review requested due to automatic review settings August 3, 2026 13:20
@Aias00
Aias00 requested a review from openai0229 as a code owner August 3, 2026 13:20
@openai0229 openai0229 moved this to In Review in Chat2DB Community Aug 3, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens DDL generation in the SPI layer by SQL-standard escaping of single quotes inside COMMENT literals, preventing malformed DDL when comments contain apostrophes and reducing literal-breakout (injection) risk.

Findings (need attention):

  • chat2db-community-server/chat2db-community-spi/.../DBStructUtils.java:144-146: generateTableCommentSQL emits IS '' when comment == null, which sets an empty-string comment rather than removing the comment (standard removal is IS NULL for COMMENT statements on PostgreSQL/Oracle-style dialects).

Changes:

  • Escape ' as '' for MySQL-style inline column COMMENT '...' in create-table SQL generation.
  • Escape ' as '' for COMMENT ON COLUMN ... IS '...'.
  • Escape ' as '' for COMMENT ON TABLE ... IS '...', with a null guard.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
chat2db-community-server/chat2db-community-spi/src/main/java/ai/chat2db/spi/util/DBStructUtils.java Escapes single quotes in generated column/table comment DDL; adjusts null handling for table comments (currently to empty string).
chat2db-community-server/chat2db-community-spi/src/main/java/ai/chat2db/spi/DefaultSqlBuilder.java Escapes single quotes in COMMENT ON COLUMN ... IS '...' generation used by the default DDL table builder.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@openai0229 openai0229 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed after correcting null comment removal and adding regression coverage for apostrophes and backslashes. All 16 targeted SPI tests pass locally.

@openai0229
openai0229 merged commit 8b95661 into OtterMind:main Aug 3, 2026
25 checks passed
@openai0229 openai0229 moved this from In Review to Done in Chat2DB Community Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

bug(sql): COMMENT text is not escaped, apostrophes break DDL (and enable injection)

3 participants