CurtHagenlocher opened a new pull request, #4757: URL: https://github.com/apache/arrow-adbc/pull/4757
The metadata queries in `GetObjects` and `GetTableSchema` built INFORMATION_SCHEMA SQL by interpolating caller-supplied catalog, dataset, table, and column values and patterns directly into the query text, relying on a regex allowlist. That allowlist was in tension with the fact that some legitimate BigQuery identifier and pattern values (for example, table names containing Unicode letters, spaces, or the '%' wildcard) don't satisfy it. This change tightens identifier handling and removes the interpolation: - Every caller-supplied value across all six INFORMATION_SCHEMA queries is now bound as a query parameter rather than interpolated into the SQL text. - The catalog and dataset that name the view can't be parameters (BigQuery doesn't support binding identifiers), so those are still validated against an allowlist, now anchored with \A/\z instead of ^/$ (since .NET's $ also matches before a trailing newline). Rejected values are no longer echoed into the exception message, since a rejected value could itself contain characters - including newlines and other control characters - that might forge or split log/error output if interpolated there. - Search patterns (used for catalog, dataset, table, and column name filters) are now handled correctly: BigQuery's LIKE evaluates '%' and '_' as wildcards once the pattern is bound as a parameter, whereas the old allowlist rejected any pattern containing '%', and separately rejected Unicode letters/spaces that BigQuery permits in identifiers. - Catalog and dataset patterns, which are matched client-side via PatternToRegEx, are aligned with the table/column patterns, which are matched server-side via LIKE: every literal character is now escaped (previously '.' matched any character and '[' threw), and matching is now case-sensitive in both paths, matching BigQuery's own case-sensitive dataset and table names. - EscapeLikePattern doubles backslashes so that user-supplied '\' characters remain literal under BigQuery's LIKE escaping, per the ADBC search pattern semantics (which give special meaning only to '%' and '_', with no other escaping supported). Breaking changes, all of them cases that were previously incorrect: - Catalog and dataset patterns now match case-sensitively. - Regex metacharacters in a catalog or dataset pattern are literal. - A catalog or dataset containing a character outside [a-zA-Z0-9_-] is rejected rather than truncated past the first invalid character. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
