java

Author: tope99

compiler/extensions/java/freemarker/SqlDatabase.java.ftl

@@ -335,12 +335,17 @@ public final class ${name} implements zserio.runtime.SqlDatabase<#if !withWriter
     private void attachDatabase(java.lang.String dbFileName, java.lang.String attachedDbName)
             throws java.sql.SQLException
     {
-        final java.lang.StringBuilder sqlQuery = new java.lang.StringBuilder("ATTACH DATABASE '");
-        sqlQuery.append(new java.io.File(dbFileName).toString());
-        sqlQuery.append("' AS ");
-        sqlQuery.append(attachedDbName);
-        executeUpdate(sqlQuery.toString());
-
+        for (char chr : attachedDbName.toCharArray())
+        {
+            if (chr != '_' && !Character.isLetterOrDigit(chr))
+                throw new zserio.runtime.ZserioError("${name}.attachDatabase: attached DB name contains invalid characters");
+        }
+        final String sqlQuery = "ATTACH DATABASE ? AS " + attachedDbName;
+        try (java.sql.PreparedStatement stmt = connection.prepareStatement(sqlQuery))
+        {
+            stmt.setString(1,  new java.io.File(dbFileName).toString());
+            stmt.executeUpdate();
+        }
         attachedDbList.add(attachedDbName);
     }
 

test/extensions/language/sql_databases/java/sql_databases/db_with_relocation/DbWithRelocationTest.java

@@ -21,6 +21,7 @@
 import org.junit.jupiter.api.Test;
 
 import zserio.runtime.SqlDatabase;
+import zserio.runtime.ZserioError;
 import zserio.runtime.validation.ValidationReport;
 
 import test_utils.FileUtil;
@@ -188,6 +189,18 @@ public void checkAttachedDatabases() throws SQLException
         assertFalse(attachedDatabaseNames.contains("main"));
     }
 
+    @Test
+    public void checkInvalidDbName()
+    {
+        final String dbName = "db_with_relocation_test_invalid_db_name.sqlite";
+        final Map<String, String> reloc1 = new HashMap<String, String>();
+        reloc1.put("inval id", "db_with_relocation_test_invalid1.sqlite");
+        final Map<String, String> reloc2 = new HashMap<String, String>();
+        reloc2.put("in?valid", "db_with_relocation_test_invalid1.sqlite");
+        assertThrows(ZserioError.class, () -> { new EuropeDb(dbName, reloc1); });
+        assertThrows(ZserioError.class, () -> { new EuropeDb(dbName, reloc2); });
+    }
+
     private static boolean isRelocatedTableInDb(String relocatedTableName, SqlDatabase db) throws SQLException
     {
         // check if database does contain relocated table