Maven publish & securities

- Escaped Table name (SQL Injection Security)

Author: Niwer1525

src/main/java/niwer/queryon/DataBase.java

@@ -135,7 +135,7 @@ public Table getTable(Class<? extends Table> tableClass) {
      */
     public boolean tabExists(Table table) {
         this.reconnect(); // Ensure the connection is active before executing the query
-        try (final var STATEMENT = this.sqlConnection.prepareStatement("SELECT name FROM sqlite_master WHERE type='table' AND name='" + table.name() + "';")) {
+        try (final var STATEMENT = this.sqlConnection.prepareStatement("SELECT name FROM sqlite_master WHERE type='table' AND name=" + table.escapedName() + ";")) {
             return STATEMENT.executeQuery().next(); // If the query returns a result, the table exists
         } catch (SQLException e) {
             Console.log("Failed to check if table exists: " + e.getMessage()).type(QueryonLogTypes.SQL).error().container(QueryonEngine.LOGGER).send();
@@ -165,7 +165,7 @@ public boolean tabExists(Class<? extends Table> tableClass) {
     protected Table dropTable(Class<? extends Table> tableClass) {
         final Table table = this.getTable(tableClass);
         Console.log("Unregistering and dropping table " + table.name()).type(QueryonLogTypes.SQL).container(QueryonEngine.LOGGER).send();
-        QueryManager.query(this, "DROP TABLE IF EXISTS " + table.name() + ";");
+        QueryManager.query(this, "DROP TABLE IF EXISTS " + table.escapedName() + ";");
         REGISTERED_TABLES.remove(table);
         return table;
     }

src/main/java/niwer/queryon/queries/interaction/DeletionManager.java

@@ -32,7 +32,7 @@ public final DeletionManager where(Expression expression) {
 
     @Override
     protected String buildQuery() {
-        final StringBuilder QUERY = new StringBuilder("DELETE FROM ").append(TABLE.name());
+        final StringBuilder QUERY = new StringBuilder("DELETE FROM ").append(TABLE.escapedName());
 
         /* Add WHERE condition */
         if (this.whereCondition != null) QUERY.append(" WHERE ").append(this.whereCondition);

src/main/java/niwer/queryon/queries/interaction/InsertionManager.java

@@ -108,7 +108,7 @@ public final InsertionManager onConflictDoUpdate(UpdateManager updateManager) {
     protected String buildQuery() {
         final StringBuilder QUERY = new StringBuilder("INSERT");
         if (IGNORE_CONFLICTS) QUERY.append(" OR IGNORE");
-        QUERY.append(" INTO ").append(TABLE.name()).append(" (").append(QueryonEngine.formatValues(COLUMNS)).append(") VALUES ");
+        QUERY.append(" INTO ").append(TABLE.escapedName()).append(" (").append(QueryonEngine.formatValues(COLUMNS)).append(") VALUES ");
 
         /* Add objects */
         final String VALUES_SQL = ROWS.stream()
@@ -121,7 +121,7 @@ protected String buildQuery() {
             case NONE -> { /* No conflict resolution, do nothing */ }
             case DO_NOTHING -> QUERY.append(" ON CONFLICT DO NOTHING");
             case DO_UPDATE -> {
-                QUERY.append(" ON CONFLICT DO UPDATE SET ").append(doUpdateManager.buildQuery().replaceFirst("UPDATE " + TABLE.name() + " SET ", ""));
+                QUERY.append(" ON CONFLICT DO UPDATE SET ").append(doUpdateManager.buildQuery().replaceFirst("UPDATE " + TABLE.escapedName() + " SET ", ""));
             }
         }
 

src/main/java/niwer/queryon/queries/interaction/SelectionManager.java

@@ -99,7 +99,7 @@ public final SelectionManager limit(int limit) {
     protected String buildQuery() {
         final StringBuilder QUERY = new StringBuilder("SELECT ");
         if (IS_DISTINCT) QUERY.append("DISTINCT ");
-        QUERY.append(QueryonEngine.formatValues(COLUMNS)).append(" FROM ").append(TABLE.name());
+        QUERY.append(QueryonEngine.formatValues(COLUMNS)).append(" FROM ").append(TABLE.escapedName());
 
         /* Add where */
         if (whereCondition != null) QUERY.append(" WHERE ").append(whereCondition.toString());

src/main/java/niwer/queryon/queries/interaction/UpdateManager.java

@@ -85,7 +85,7 @@ public final UpdateManager where(Expression expression) {
     @Override
     protected String buildQuery() {
         if (this.SETS.isEmpty()) throw new IllegalStateException("At least one column must be set for an update query.");
-        final StringBuilder QUERY = new StringBuilder("UPDATE " + this.TABLE.name() + " SET " + String.join(", ", this.SETS));
+        final StringBuilder QUERY = new StringBuilder("UPDATE " + this.TABLE.escapedName() + " SET " + String.join(", ", this.SETS));
 
         /* Where condition */
         if (this.whereCondition != null) QUERY.append(" WHERE ").append(this.whereCondition.toString());

src/main/java/niwer/queryon/tables/Column.java

@@ -222,7 +222,7 @@ public String toString() {
 
     protected final String constraintSQL() {
         if (foreignKeyReferenceTable == null || foreignKeyReferenceColumn == null) return null;
-        return String.format("FOREIGN KEY (%s) REFERENCES %s(%s)%s", NAME, foreignKeyReferenceTable.name(), foreignKeyReferenceColumn, " ON DELETE " + foreignKeyDeleteAction);
+        return String.format("FOREIGN KEY (%s) REFERENCES %s(%s)%s", NAME, foreignKeyReferenceTable.escapedName(), foreignKeyReferenceColumn, " ON DELETE " + foreignKeyDeleteAction);
     }
 
     @Override public int hashCode() { return NAME.hashCode(); }

src/main/java/niwer/queryon/tables/Table.java

@@ -34,11 +34,16 @@ public Table(DataBase db) {
     }
 
     public abstract String name();
+
+    public final String escapedName() {
+        return "'" + this.name() + "'";
+    }
 
     public final Set<Column> columns() { return Set.copyOf(COLUMNS); }
 
     /**
      * Helper method to create a column definition for the table. It supports basic column types (INT, VARCHAR, BOOLEAN) and allows to set various constraints (NOT NULL, UNIQUE, AUTO_INCREMENT, PRIMARY KEY) and default values.
+     * 
      * @param name The name of the column
      * @param type The type of the column (INT, VARCHAR, BOOLEAN)
      * @return An SQLColumn instance that can be further configured with constraints and default values, and then added to a table definition using SQLTable.addColumn()
@@ -49,6 +54,7 @@ protected final static Column createColumn(DataBase db, String name, EnumColumnT
 
     /**
      * Helper method to create a VARCHAR column definition for the table. It allows to specify the size of the VARCHAR column and supports the same constraints and default values as createColumn.
+     * 
      * @param name The name of the column
      * @param size The size of the VARCHAR column (maximum number of characters)
      * @return An SQLColumn instance that can be further configured with constraints and default values, and then added to a table definition using SQLTable.addColumn()

src/test/java/niwer/queryon/queries/interaction/DeletionManagerTest.java

@@ -20,12 +20,12 @@ class DeletionManagerTest {
 
         final String DELETE = DeletionManager.delete(DB, TestUserTable.class)
             .buildQuery();
-        assertEquals("DELETE FROM test_table", DELETE);
+        assertEquals("DELETE FROM 'test_table'", DELETE);
 
         final String DELETE_WHERE = DeletionManager.delete(DB, TestUserTable.class)
             .where(Expression.of("name").like("%A%"))
             .buildQuery();
-        assertEquals("DELETE FROM test_table WHERE name LIKE '%A%'", DELETE_WHERE);
+        assertEquals("DELETE FROM 'test_table' WHERE name LIKE '%A%'", DELETE_WHERE);
     }
 
     @Test void testExecute(@TempDir File tempDir) {

src/test/java/niwer/queryon/queries/interaction/InsertionManagerTest.java

@@ -24,27 +24,27 @@ class InsertionManagerTest {
             .row(1, "Alice", 30)
             .rows(InsertionManager.of(2, "Bob", 25), InsertionManager.of(3, "Carol", 28))
             .buildQuery();
-        assertEquals("INSERT INTO test_table (id, name, age) VALUES (1, 'Alice', 30), (2, 'Bob', 25), (3, 'Carol', 28)", INSERT);
+        assertEquals("INSERT INTO 'test_table' (id, name, age) VALUES (1, 'Alice', 30), (2, 'Bob', 25), (3, 'Carol', 28)", INSERT);
 
         final String INSERT_OR_IGNORE = InsertionManager.insertOrIgnore(DB, TestUserTable.class, "id", "name", "age")
             .row(1, "Alice", 30)
             .rows(InsertionManager.of(2, "Bob", 25), InsertionManager.of(3, "Carol", 28))
             .buildQuery();
-        assertEquals("INSERT OR IGNORE INTO test_table (id, name, age) VALUES (1, 'Alice', 30), (2, 'Bob', 25), (3, 'Carol', 28)", INSERT_OR_IGNORE);
+        assertEquals("INSERT OR IGNORE INTO 'test_table' (id, name, age) VALUES (1, 'Alice', 30), (2, 'Bob', 25), (3, 'Carol', 28)", INSERT_OR_IGNORE);
 
         final String INSERT_DO_NOTHING = InsertionManager.insertOrIgnore(DB, TestUserTable.class, "id", "name", "age")
             .row(1, "Alice", 30)
             .onConflictDoNothing()
             .buildQuery();
-        assertEquals("INSERT OR IGNORE INTO test_table (id, name, age) VALUES (1, 'Alice', 30) ON CONFLICT DO NOTHING", INSERT_DO_NOTHING);
+        assertEquals("INSERT OR IGNORE INTO 'test_table' (id, name, age) VALUES (1, 'Alice', 30) ON CONFLICT DO NOTHING", INSERT_DO_NOTHING);
 
         final String INSERT_DO_UPDATE = InsertionManager.insertOrIgnore(DB, TestUserTable.class, "id", "name", "age")
             .row(1, "Alice", 30)
             .onConflictDoUpdate(
                 UpdateManager.update(DB, TestUserTable.class).set("name", "Alice Updated").where(Expression.of("id").isEqualTo(1))
             )
             .buildQuery();
-        assertEquals("INSERT OR IGNORE INTO test_table (id, name, age) VALUES (1, 'Alice', 30) ON CONFLICT DO UPDATE SET name = 'Alice Updated' WHERE id = 1", INSERT_DO_UPDATE);
+        assertEquals("INSERT OR IGNORE INTO 'test_table' (id, name, age) VALUES (1, 'Alice', 30) ON CONFLICT DO UPDATE SET name = 'Alice Updated' WHERE id = 1", INSERT_DO_UPDATE);
     }
 
     @Test void testInsertionInvalidValues(@TempDir File tempDir) {

src/test/java/niwer/queryon/queries/interaction/SelectionManagerTest.java

@@ -25,36 +25,36 @@ class SelectionManagerTest {
 
         final String SELECT_ALL = SelectionManager.select(DB, TestUserTable.class)
             .buildQuery();
-        assertEquals("SELECT * FROM test_table", SELECT_ALL);
+        assertEquals("SELECT * FROM 'test_table'", SELECT_ALL);
 
         final String SELECT_DISTINCT = SelectionManager.selectDistinct(DB, TestUserTable.class)
             .buildQuery();
-        assertEquals("SELECT DISTINCT * FROM test_table", SELECT_DISTINCT);
+        assertEquals("SELECT DISTINCT * FROM 'test_table'", SELECT_DISTINCT);
 
         final String SELECT_COLUMNS = SelectionManager.select(DB, TestUserTable.class, "id", "name")
             .buildQuery();
-        assertEquals("SELECT id, name FROM test_table", SELECT_COLUMNS);
+        assertEquals("SELECT id, name FROM 'test_table'", SELECT_COLUMNS);
 
         final String SELECT_COLUMNS_WHERE = SelectionManager.select(DB, TestUserTable.class, "id", "name")
             .where(Expression.of("age").isGreaterThan(25))
             .limit(25)
             .buildQuery();
-        assertEquals("SELECT id, name FROM test_table WHERE age > 25 LIMIT 25", SELECT_COLUMNS_WHERE);
+        assertEquals("SELECT id, name FROM 'test_table' WHERE age > 25 LIMIT 25", SELECT_COLUMNS_WHERE);
 
         final String SELECT_COLUMNS_ORDER_BY = SelectionManager.select(DB, TestUserTable.class, "id", "name")
             .orderBy("id", EnumOrder.ASC)
             .orderBy("email", EnumOrder.ASC)
             .orderBy("name", EnumOrder.DESC)
             .buildQuery();
-        assertEquals("SELECT id, name FROM test_table ORDER BY id ASC, email ASC, name DESC", SELECT_COLUMNS_ORDER_BY);
+        assertEquals("SELECT id, name FROM 'test_table' ORDER BY id ASC, email ASC, name DESC", SELECT_COLUMNS_ORDER_BY);
 
         final String SELECT_COLUMNS_ORDER_BY_WHERE = SelectionManager.select(DB, TestUserTable.class, "id", "name")
             .where(Expression.of("age").isGreaterThan(25))
             .orderBy("id", EnumOrder.ASC)
             .orderBy("email", EnumOrder.ASC)
             .orderBy("name", EnumOrder.DESC)
             .buildQuery();
-        assertEquals("SELECT id, name FROM test_table WHERE age > 25 ORDER BY id ASC, email ASC, name DESC", SELECT_COLUMNS_ORDER_BY_WHERE);
+        assertEquals("SELECT id, name FROM 'test_table' WHERE age > 25 ORDER BY id ASC, email ASC, name DESC", SELECT_COLUMNS_ORDER_BY_WHERE);
     }
 
     @Test void testSelectionInvalidValues(@TempDir File tempDir) {