From: Caolán McNamara <caolan.mcnamara@collabora.com>
Date: Sun, 12 Jul 2026 18:29:50 +0000 (+0000)
Subject: [PATCH] sc: quote the table name in the sql data provider query
X-Git-Tag: archive/raspbian/4%25.2.3-2+rpi1+deb13u8^2~9
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=2c6aea55ad54722f7e745a61a7bcb411d463aa57;p=libreoffice.git

[PATCH] sc: quote the table name in the sql data provider query

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I27a52fe9b3a3d9a9703589b74df259baf2312c46
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6707
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 1d24f1b1937995936011f61b6c1436d821f66faf)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208009
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
(cherry picked from commit d7712feea1d1992c62f72aeeec32c2053556898b)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208033
Reviewed-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Tested-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>

Gbp-Pq: Name CVE-2026-63268-1.diff
---

diff --git a/sc/source/ui/dataprovider/sqldataprovider.cxx b/sc/source/ui/dataprovider/sqldataprovider.cxx
index 7521e340ca7..31ec91d0e46 100644
--- a/sc/source/ui/dataprovider/sqldataprovider.cxx
+++ b/sc/source/ui/dataprovider/sqldataprovider.cxx
@@ -18,6 +18,8 @@
 #include <com/sun/star/sdbc/XRow.hpp>
 #include <com/sun/star/sdbc/XResultSetMetaDataSupplier.hpp>
 #include <com/sun/star/sdbc/XResultSetMetaData.hpp>
+#include <com/sun/star/sdbc/XDatabaseMetaData.hpp>
+#include <connectivity/dbtools.hxx>
 #include <dbdocutl.hxx>
 #include <datamapper.hxx>
 #include <utility>
@@ -89,10 +91,13 @@ void SQLFetchThread::execute()
 
         uno::Reference<sdbc::XConnection> xConnection = xSource->connectWithCompletion(xHandler);
 
+        const OUString aQuote = xConnection->getMetaData()->getIdentifierQuoteString();
+        const OUString aQuotedTable = ::dbtools::quoteName(aQuote, aTable);
+
         uno::Reference<sdbc::XStatement> xStatement = xConnection->createStatement();
 
         uno::Reference<sdbc::XResultSet> xResult
-            = xStatement->executeQuery("SELECT * FROM " + aTable);
+            = xStatement->executeQuery("SELECT * FROM " + aQuotedTable);
 
         if (xResult.is())
         {