Skip to content

Escape single quotes in string literals pushed to Cassandra and Geode #5075

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Samin061 wants to merge 2 commits into
base: main
Choose a base branch
from
+36 −2
Open

Escape single quotes in string literals pushed to Cassandra and Geode #5075

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
688c6b4
Escape single quotes in string literals pushed to Cassandra and Geode
Samin061 Jul 4, 2026
16fe1e5
Add test for adjacent single quotes in pushed Geode literal
Samin061 Jul 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cassandra/src/main/java/org/apache/calcite/adapter/cassandra/CassandraFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,7 +302,7 @@ private String translateOp2(String op, String name, RexLiteral right) {
requireNonNull(rowType.getField(name, true, false));
SqlTypeName typeName = field.getType().getSqlTypeName();
if (typeName != SqlTypeName.CHAR) {
valueString = "'" + valueString + "'";
valueString = "'" + valueString.replace("'", "''") + "'";

@xiedeyantu xiedeyantu Jul 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the value is I''m fine, I think replace will return an unexpected results.

@Samin061 Samin061 Jul 5, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

String.replace here is literal, not regex, so it doubles every embedded quote independently. For the value I''m fine (two adjacent quotes) it produces 'I''''m fine', which the CQL/OQL parser reads back as exactly I''m fine, so it round-trips fine. This is the same doubling core already does in SqlDialect.quoteStringLiteral (val.replace(literalEndQuoteString, literalEscapedQuote)). I pushed a Geode test with that exact value to lock it in.

@xiedeyantu xiedeyantu Jul 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apologies, I misunderstood the situation. I think this change is good; you can create a Jira ticket and—following the example of other PRs—update the title and adjust the commit message accordingly.

@Samin061 Samin061 Jul 6, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No worries. I'll open a CALCITE ticket for this and update the PR title and commit message to the [CALCITE-XXXX] form to match the other PRs, and squash the two commits down to one while I'm at it.

}
}
return name + " " + op + " " + valueString;
Expand Down
9 changes: 9 additions & 0 deletions cassandra/src/test/java/org/apache/calcite/test/CassandraAdapterTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,15 @@ static void load(CqlSession session) {
+ " CassandraTableScan(table=[[twissandra, userline]]");
}

@Test void testFilterWithSingleQuote() {
// A string literal containing a single quote must be escaped so it does not
// break out of the CQL string literal in the generated query.
CalciteAssert.that()
.with(TWISSANDRA)
.query("select * from \"userline\" where \"username\" = 'a''b'")
.returnsCount(0);
}

@Test void testFilterUUID() {
CalciteAssert.that()
.with(TWISSANDRA)
Expand Down
2 changes: 1 addition & 1 deletion geode/src/main/java/org/apache/calcite/adapter/geode/rel/GeodeFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,7 +395,7 @@ private String translateBinary2(String op, RexNode left,
private static String quoteCharLiteral(RexLiteral literal) {
String value = literalValue(literal);
if (literal.getTypeName() == CHAR) {
value = "'" + value + "'";
value = "'" + value.replace("'", "''") + "'";
}
return value;
}
Expand Down
25 changes: 25 additions & 0 deletions geode/src/test/java/org/apache/calcite/adapter/geode/rel/GeodeZipsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,31 @@ public void testJoin() {
GeodeAssertions.query(expectedQuery));
}

@Test void testFilterWithSingleQuoteLiteral() {
String expectedQuery = "SELECT city AS city FROM /zips "
+ "WHERE city = 'a''b'";
calciteAssert()
.query("SELECT city as city "
+ "FROM view WHERE city = 'a''b'")
.returnsCount(0)
.queryContains(
GeodeAssertions.query(expectedQuery));
}

/** Value that already contains adjacent single quotes: the literal {@code 'I''''m fine'}
* denotes the runtime value {@code I''m fine}, and every embedded quote is doubled so the
* OQL round-trips back to that same value. */
@Test void testFilterWithAdjacentSingleQuoteLiteral() {
String expectedQuery = "SELECT city AS city FROM /zips "
+ "WHERE city = 'I''''m fine'";
calciteAssert()
.query("SELECT city as city "
+ "FROM view WHERE city = 'I''''m fine'")
.returnsCount(0)
.queryContains(
GeodeAssertions.query(expectedQuery));
}

@Test void testWhereWithOrForNumericField() {
calciteAssert()
.query("SELECT pop as pop "
Expand Down
Loading