#795 view column expressions are not escaped properly

CapsicoHealth · Oct 5, 2023 · 92ebf2f · 92ebf2f
1 parent 272f4af
commit 92ebf2f
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/src/tilda/generation/bigquery/Sql.java b/src/tilda/generation/bigquery/Sql.java
@@ -510,7 +510,7 @@ private boolean PrintViewColumn(StringBuilder Str, ViewColumn VC, TableRankTrack
         // If the column has a sameAs string, but no sameAsObj and is managed, then we print the sameAs as is.
         if (VC.isSameAsLitteral() == true)
           {
-            Str.append(TextUtil.isNullOrEmpty(VC._Expression) == true ? VC._SameAs : VC._Expression.replaceAll("\\?", VC._SameAs));
+            Str.append(TextUtil.isNullOrEmpty(VC._Expression) == true ? VC._SameAs : rewriteExpressionColumnQuoting(VC._Expression.replaceAll("\\?", VC._SameAs)));
           }
         else
           {
@@ -530,7 +530,7 @@ private boolean PrintViewColumn(StringBuilder Str, ViewColumn VC, TableRankTrack
               Str.append("trim(");
             String ColExpr = VC._Aggregate != null && VC._Aggregate.isWindowOnly() == true ? "" : (textConversionNeeded ? "CAST(" : "") + TI.getFullName() + "." + getShortColumnVar(VC._SameAsObj.getName()) + (textConversionNeeded ? " AS STRING)" : "");
             if (TextUtil.isNullOrEmpty(VC._Expression) == false)
-              ColExpr = VC._Expression.replaceAll("\\?", ColExpr);
+              ColExpr = rewriteExpressionColumnQuoting(VC._Expression.replaceAll("\\?", ColExpr));
             boolean filteredAggregate = VC._Aggregate != null &&  TextUtil.isNullOrEmpty(VC._Filter) == false;
             if (filteredAggregate == true && supportsFilterClause() == false)
              Str.append("case when ").append(rewriteExpressionColumnQuoting(VC._Filter)).append(" then ");
@@ -1032,7 +1032,7 @@ public String genPivotColumnSQL(ViewColumn VC)
 
         String Expr = Str.toString();
         if (TextUtil.isNullOrEmpty(VC._Expression) == false)
-          Expr = VC._Expression.replaceAll("\\?", Expr);
+          Expr = rewriteExpressionColumnQuoting(VC._Expression.replaceAll("\\?", Expr));
 
         if (TextUtil.isNullOrEmpty(VC._Coalesce) == false)
           Expr = "coalesce(" + Expr + ", " + ValueHelper.printValueSQL(getSQlCodeGen(), VC.getName(), VC.getType(), VC.isCollection(), VC._Coalesce) + ")";

diff --git a/src/tilda/generation/postgres9/Sql.java b/src/tilda/generation/postgres9/Sql.java
@@ -677,7 +677,7 @@ private boolean PrintViewColumn(StringBuilder Str, ViewColumn VC, TableRankTrack
         // If the column has a sameAs string, but no sameAsObj and is managed, then we print the sameAs as is.
         if (VC.isSameAsLitteral() == true)
           {
-            Str.append(TextUtil.isNullOrEmpty(VC._Expression) == true ? VC._SameAs : VC._Expression.replaceAll("\\?", VC._SameAs));
+            Str.append(TextUtil.isNullOrEmpty(VC._Expression) == true ? VC._SameAs : rewriteExpressionColumnQuoting(VC._Expression.replaceAll("\\?", VC._SameAs)));
           }
         else
           {
@@ -697,7 +697,7 @@ private boolean PrintViewColumn(StringBuilder Str, ViewColumn VC, TableRankTrack
               Str.append("trim(");
             String ColExpr = VC._Aggregate != null && VC._Aggregate.isWindowOnly() == true ? "" : TI.getFullName() + ".\"" + VC._SameAsObj.getName() + "\"" + (textConversionNeeded ? "::TEXT" : "");
             if (TextUtil.isNullOrEmpty(VC._Expression) == false)
-              ColExpr = VC._Expression.replaceAll("\\?", ColExpr);
+              ColExpr = rewriteExpressionColumnQuoting(VC._Expression.replaceAll("\\?", ColExpr));
             Str.append(ColExpr);
             if (trimNeeded)
               Str.append(")");
@@ -1184,7 +1184,7 @@ public String genPivotColumnSQL(ViewColumn VC)
 
         String Expr = Str.toString();
         if (TextUtil.isNullOrEmpty(VC._Expression) == false)
-          Expr = VC._Expression.replaceAll("\\?", Expr);
+          Expr = rewriteExpressionColumnQuoting(VC._Expression.replaceAll("\\?", Expr));
 
         if (TextUtil.isNullOrEmpty(VC._Coalesce) == false)
           Expr = "coalesce(" + Expr + ", " + ValueHelper.printValueSQL(getSQlCodeGen(), VC.getName(), VC.getType(), VC.isCollection(), VC._Coalesce) + ")";