[PATCH] sc: quote the table name in the sql data provider query

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I27a52fe9b3a3d9a9703589b74df259baf2312c46
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6707
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 1d24f1b1937995936011f61b6c1436d821f66faf)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208009
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
(cherry picked from commit d7712feea1d1992c62f72aeeec32c2053556898b)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208033
Reviewed-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Tested-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Gbp-Pq: Name CVE-2026-63268-1.diff

diff --git a/sc/source/ui/dataprovider/sqldataprovider.cxx b/sc/source/ui/dataprovider/sqldataprovider.cxx
index 7521e340ca7a7042e930e129d91939573ce63de3..31ec91d0e462aed9fecfc3bea54600a383cba9eb 100644 (file)
--- a/sc/source/ui/dataprovider/sqldataprovider.cxx
+++ b/sc/source/ui/dataprovider/sqldataprovider.cxx
@@ -18,6 +18,8 @@
 #include <com/sun/star/sdbc/XRow.hpp>
 #include <com/sun/star/sdbc/XResultSetMetaDataSupplier.hpp>
 #include <com/sun/star/sdbc/XResultSetMetaData.hpp>
+#include <com/sun/star/sdbc/XDatabaseMetaData.hpp>
+#include <connectivity/dbtools.hxx>
 #include <dbdocutl.hxx>
 #include <datamapper.hxx>
 #include <utility>
@@ -89,10 +91,13 @@ void SQLFetchThread::execute()
 
         uno::Reference<sdbc::XConnection> xConnection = xSource->connectWithCompletion(xHandler);
 
+        const OUString aQuote = xConnection->getMetaData()->getIdentifierQuoteString();
+        const OUString aQuotedTable = ::dbtools::quoteName(aQuote, aTable);
+
         uno::Reference<sdbc::XStatement> xStatement = xConnection->createStatement();
 
         uno::Reference<sdbc::XResultSet> xResult
-            = xStatement->executeQuery("SELECT * FROM " + aTable);
+            = xStatement->executeQuery("SELECT * FROM " + aQuotedTable);
 
         if (xResult.is())
         {