Skip to content

Validate and escape table identifiers in JDBC sink operators - #839

Open
AliRana30 wants to merge 1 commit into
apache:mainfrom
AliRana30:fix/validate-escape-table-identifiers-836
Open

AliRana30 wants to merge 1 commit into
apache:mainfrom
AliRana30:fix/validate-escape-table-identifiers-836

Conversation

@AliRana30

Copy link
Copy Markdown
Contributor

Key Changes

  • SqlIdentifierUtils: Added a utility in wayang-basic to strictly validate single-part and multipart table/column identifiers using regex patterns (^[a-zA-Z_][a-zA-Z0-9_$]*(?:\.[a-zA-Z_][a-zA-Z0-9_$]*)*$) and escape/quote identifiers according to database dialect.
  • TableSink: Integrated validation in the constructor and setter so any invalid or malicious table/column identifier is rejected early with an IllegalArgumentException.
  • JdbcTableSinkOperator & JdbcExecutor: Quoted table names in generated DROP TABLE IF EXISTS, CREATE TABLE ... AS, and INSERT INTO clauses. Multipart identifiers (such as Trino catalog.schema.table) are quoted segment-by-segment ("catalog"."schema"."table").
  • JavaTableSink & SparkTableSink: Updated to use SqlIdentifierUtils for safe identifier quoting.
  • Unit Tests: Added SqlIdentifierUtilsTest and updated JdbcTableSinkExecutorTest to assert proper quoting and rejection of SQL injection payloads.

Fixes : #836.

Verification

  • SqlIdentifierUtilsTest (10 tests passed)
  • JdbcTableSinkExecutorTest (8 tests passed)
  • JavaTableSinkTest (7 tests passed)
  • SparkTableSinkTest (10 tests passed)
  • apache-rat:check (0 unapproved licenses)

Copilot AI balanced review requested due to automatic review settings October 10, 2026 23:32

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@AliRana30

Copy link
Copy Markdown
Contributor Author

@zkaoudi PR is up for your review.

@novatechflow

Copy link
Copy Markdown
Member

Thanks for the contribution. Pls always add regression tests.

  • Quoting changes identifier case handling. On HSQLDB, an existing unquoted target_append becomes TARGET_APPEND, but the new SQL targets "target_append". Append fails, and overwrite leaves the original table untouched.
  • The shared validation rejects valid BigQuery names such as my-project.sales.orders, including the documented backtick-quoted form.

Reproduced both with focused Java 17 checks. Preserve identifier lookup semantics & handle dialect-specific names.

@AliRana30
AliRana30 force-pushed the fix/validate-escape-table-identifiers-836 branch from 908cf6c to 76fecd5 Compare October 21, 2026 22:39
@AliRana30

Copy link
Copy Markdown
Contributor Author

@novatechflow I have addressed both issues and added regression tests covering both case folding and BigQuery formats. Verified on Java 17

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Improvement] Validate and escape table identifiers in JDBC sink operators

3 participants