mrdevel2002-ui opened a new pull request, #3447: URL: https://github.com/apache/tika/pull/3447
`JDBCTableReader.reset` builds `"SELECT * from " + tableName`, and for `SQLite3Parser` and `GeoPkgParser` that name is read from the parsed file's `sqlite_master`, so file content reaches the SQL text unquoted. A table whose name needs quoting (`my table`, `order`, `say "hi"`) makes the SELECT fail and the parse ends in an exception at that table. A crafted file can also name a table `a WHERE 0 UNION ALL SELECT sqlite_version()`, which Tika runs and reports as that table's content: `3.53.4` on main, a value that is not stored in the file. The injected text is limited to one SELECT on the read-only connection (sqlite-jdbc ignores anything after the first statement and `load_extension` is refused), so it does not reach outside the database, but the file chooses the query the parser runs and what it reports. The fix quotes the name as an SQL identifier, doubling embedded double quotes, in `JDBCTableReader` so the SQLite and GeoPackage readers both get it. Double quotes are standard SQL identifier quoting and what SQLite expects; `SQLite3TableReader` is the only reader in the tree, so I kept that over `DatabaseMetaData.getIdentifierQuoteString()` and its fallback handling. `testTableNamesThatNeedQuoting` and `testTableNameIsNotRunAsSql` in `SQLite3ParserTest` build the database in a `@TempDir`. Both fail on main (the first with the exception from the failed SELECT, the second with `beta not found` because the second table returned the injected rows) and pass here. `./mvnw clean install` of `tika-parser-jdbc-commons` and `tika-parser-sqlite3-module` (tests, checkstyle, spotless, forbidden-apis) is green, and `SQLite3ParserTest` in `tika-parsers-extended-integration-tests` passes. - [ ] open issue on the Tika issue tracker: not filed yet, happy to open one or have it linked - [ ] issue ID in the PR title and commit message: pending the issue above - [x] commits are squashed into a single one - [x] Tika builds and unit tests pass with `./mvnw clean install` (affected modules) - [x] generative AI tool used: the commit carries `Generated-by:` per the ASF Generative Tooling Guidance. This fix was found and prepared with AI assistance and reviewed by me before submitting. - [x] no conflicts with the recent `main` branch - [ ] new downstream module added to `tika-bom/pom.xml`: not applicable -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
