@cubejs-backend/dremio-driver 1.4.2 → 1.4.4

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.4.4](https://github.com/cube-js/cube/compare/v1.4.3...v1.4.4) (2026-07-28)
+
+### Bug Fixes
+
+- **pinot/dremio/ksql/databriks/hive/jdbc-driver:** Сorrect SQL parameter escaping ([#11374](https://github.com/cube-js/cube/issues/11374)) ([e31ccf0](https://github.com/cube-js/cube/commit/e31ccf0e040bf6df0a0898797552302352b0aa99))
+- **schema-compiler:** Escape LIKE wildcards on Tesseract for all dialects ([0432799](https://github.com/cube-js/cube/commit/04327997e013d11432b007710db51913875680ab)), closes [#11345](https://github.com/cube-js/cube/issues/11345) [#11345](https://github.com/cube-js/cube/issues/11345) [#10862](https://github.com/cube-js/cube/issues/10862) [#11345](https://github.com/cube-js/cube/issues/11345) [#11345](https://github.com/cube-js/cube/issues/11345) [#11345](https://github.com/cube-js/cube/issues/11345) [#11345](https://github.com/cube-js/cube/issues/11345) [opensearch-project/sql#779](https://github.com/opensearch-project/sql/issues/779) [#11345](https://github.com/cube-js/cube/issues/11345)
+
+## [1.4.3](https://github.com/cube-js/cube/compare/v1.4.2...v1.4.3) (2026-06-08)
+
+**Note:** Version bump only for package @cubejs-backend/dremio-driver
+
 ## [1.4.2](https://github.com/cube-js/cube/compare/v1.4.1...v1.4.2) (2025-12-16)
 
 **Note:** Version bump only for package @cubejs-backend/dremio-driver

package/driver/DremioDriver.js

@@ -7,10 +7,10 @@
 const {
   getEnv,
   assertDataSource,
+  formatAnsi,
   pausePromise,
 } = require('@cubejs-backend/shared');
 const axios = require('axios');
-const SqlString = require('sqlstring');
 const { BaseDriver } = require('@cubejs-backend/base-driver');
 const DremioQuery = require('./DremioQuery');
 
@@ -18,7 +18,7 @@ const DremioQuery = require('./DremioQuery');
 // @see https://docs.dremio.com/rest-api/jobs/get-job.html
 const DREMIO_JOB_LIMIT = 500;
 
-const applyParams = (query, params) => SqlString.format(query, params);
+const applyParams = (query, params) => formatAnsi(query, params);
 
 /**
  * Dremio driver class.
@@ -207,12 +207,7 @@ class DremioDriver extends BaseDriver {
   }
 
   async query(query, values) {
-    const queryString = applyParams(
-      query,
-      (values || []).map(s => (typeof s === 'string' ? {
-        toSqlString: () => SqlString.escape(s).replace(/\\\\([_%])/g, '\\$1').replace(/\\'/g, '\'\'')
-      } : s))
-    );
+    const queryString = applyParams(query, values || []);
 
     await this.getToken();
     const jobId = await this.executeQuery(queryString);
@@ -280,3 +275,4 @@ class DremioDriver extends BaseDriver {
 }
 
 module.exports = DremioDriver;
+module.exports.applyParams = applyParams;

package/driver/DremioQuery.js

@@ -13,10 +13,18 @@ const GRANULARITY_TO_INTERVAL = {
 };
 
 class DremioFilter extends BaseFilter {
+  /**
+   * ILIKE(<expression>, <pattern> [, <escape_character>]) → boolean
+   * Dremio's ILIKE is a function, not an operator, so `NOT` negates the call from the outside
+   * and the escape character is its optional third argument — without it
+   * BaseFilter.escapeWildcardChars has no effect, as ILIKE has no default escape character.
+   * The 3-arg form is documented for Dremio Cloud and for Software down to 24.3.x.
+   * @see https://docs.dremio.com/cloud/reference/sql/sql-functions/functions/ILIKE/
+   */
   likeIgnoreCase(column, not, param, type) {
     const p = (!type || type === 'contains' || type === 'ends') ? '%' : '';
     const s = (!type || type === 'contains' || type === 'starts') ? '%' : '';
-    return ` ILIKE (${column}${not ? ' NOT' : ''}, CONCAT('${p}', ${this.allocateParam(param)}, '${s}'))`;
+    return `${not ? 'NOT ' : ''}ILIKE(${column}, CONCAT('${p}', ${this.allocateParam(param)}, '${s}'), '\\')`;
   }
 
   castParameter() {
@@ -165,6 +173,10 @@ class DremioQuery extends BaseQuery {
     templates.functions.DATEDIFF = 'DATE_DIFF(DATE, DATE_TRUNC(\'{{ date_part }}\', {{ args[1] }}), DATE_TRUNC(\'{{ date_part }}\', {{ args[2] }}))';
     templates.expressions.interval_single_date_part = 'CAST({{ num }} as INTERVAL {{ date_part }})';
     templates.quotes.identifiers = '"';
+    // Dremio's ILIKE is a function whose optional third argument is the escape character, so
+    // `filters.like_escape_char` cannot be emitted as an ESCAPE clause. Mirror
+    // DremioFilter.likeIgnoreCase instead.
+    templates.tesseract.ilike = '{% if negated %}NOT {% endif %}ILIKE({{ expr }}, {{ pattern }}, \'\\\')';
     return templates;
   }
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "@cubejs-backend/dremio-driver",
   "description": "Cube.js Dremio driver",
   "author": "Cube Dev, Inc.",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "repository": {
     "type": "git",
     "url": "https://github.com/cube-js/cube.git",
@@ -16,21 +16,21 @@
     "tsc": "tsc",
     "watch": "tsc -w",
     "test": "yarn integration",
+    "unit": "jest --verbose dist/test/unit",
     "integration": "npm run integration:dremio",
     "integration:dremio": "jest --verbose dist/test",
     "lint": "eslint driver/*.js",
     "lint:fix": "eslint driver/*.js"
   },
   "dependencies": {
-    "@cubejs-backend/base-driver": "1.4.2",
-    "@cubejs-backend/schema-compiler": "1.4.2",
-    "@cubejs-backend/shared": "1.4.2",
-    "axios": "^1.8.3",
-    "sqlstring": "^2.3.1"
+    "@cubejs-backend/base-driver": "1.4.4",
+    "@cubejs-backend/schema-compiler": "1.4.4",
+    "@cubejs-backend/shared": "1.4.4",
+    "axios": "^1.8.3"
   },
   "devDependencies": {
-    "@cubejs-backend/linter": "1.4.2",
-    "@cubejs-backend/testing-shared": "1.4.2",
+    "@cubejs-backend/linter": "1.4.4",
+    "@cubejs-backend/testing-shared": "1.4.4",
     "jest": "^29"
   },
   "license": "Apache-2.0",
@@ -40,5 +40,5 @@
   "eslintConfig": {
     "extends": "../cubejs-linter"
   },
-  "gitHead": "4e47fc6ca2fe0bb4b921e64448c647b3c0a8707a"
+  "gitHead": "1675e538f739774b1335e2e0baed8b29040b9c4d"
 }

package/test/DremioQuery.test.ts

@@ -118,4 +118,49 @@ cube(\`sales\`, {
       '("sales".sales_datetime >= TO_TIMESTAMP(?, \'YYYY-MM-DD"T"HH24:MI:SS.FFF\') AND "sales".sales_datetime <= TO_TIMESTAMP(?, \'YYYY-MM-DD"T"HH24:MI:SS.FFF\'))'
     );
   }));
+
+  const likeQuery = (operator: string, value: string) => new DremioQuery(
+    { joinGraph, cubeEvaluator, compiler },
+    {
+      measures: ['sales.count'],
+      filters: [
+        {
+          member: 'sales.category',
+          operator,
+          values: [value],
+        },
+      ],
+    }
+  );
+
+  // Dremio's ILIKE is a function: `NOT` cannot sit inside the argument list and the escape
+  // character is the third argument, without which the `\` BaseFilter.escapeWildcardChars binds
+  // would stay a literal backslash
+  it('should call ILIKE as a function with an escape character', () => compiler.compile().then(() => {
+    const [sql, params] = likeQuery('contains', 'demo').buildSqlAndParams();
+
+    expect(sql).toContain('ILIKE("sales".category, CONCAT(\'%\', ?, \'%\'), \'\\\')');
+    expect(params).toEqual(['demo']);
+  }));
+
+  it('should negate the whole ILIKE call', () => compiler.compile().then(() => {
+    const [sql] = likeQuery('notContains', 'demo').buildSqlAndParams();
+
+    expect(sql).toContain('NOT ILIKE("sales".category, CONCAT(\'%\', ?, \'%\'), \'\\\')');
+  }));
+
+  it('should escape LIKE wildcards in filter parameters', () => compiler.compile().then(() => {
+    expect(likeQuery('contains', 'a_b%').buildSqlAndParams()[1]).toEqual(['a\\_b\\%']);
+    expect(likeQuery('startsWith', '100%').buildSqlAndParams()[1]).toEqual(['100\\%']);
+    expect(likeQuery('endsWith', 'c:\\users').buildSqlAndParams()[1]).toEqual(['c:\\\\users']);
+  }));
+
+  it('should pass the escape character to ILIKE for the native planner too', () => compiler.compile().then(() => {
+    const templates = likeQuery('contains', 'demo').sqlTemplates();
+
+    expect(templates.filters.like_escape_char).toEqual('\\');
+    expect(templates.tesseract.ilike).toEqual(
+      '{% if negated %}NOT {% endif %}ILIKE({{ expr }}, {{ pattern }}, \'\\\')'
+    );
+  }));
 });

package/test/unit/params-escaping.test.ts

@@ -0,0 +1,88 @@
+/* eslint-disable quotes */
+const { applyParams } = require('../../../driver/DremioDriver');
+
+// Dremio is a Calcite-based, standard-SQL engine: a quote inside a string
+// literal is escaped by doubling it and a backslash is plain data.
+describe('DremioDriver SQL parameter escaping', () => {
+  it('preserves LIKE escape sequences emitted by the schema compiler', () => {
+    const sql = applyParams(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER(?) || '%' ESCAPE '\\'`,
+      ['new\\_order\\%'],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER('new\\_order\\%') || '%' ESCAPE '\\'`
+    );
+  });
+
+  it('does not double literal backslashes in LIKE parameters', () => {
+    const sql = applyParams(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER(?) || '%' ESCAPE '\\'`,
+      ['folder\\\\name'],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER('folder\\\\name') || '%' ESCAPE '\\'`
+    );
+  });
+
+  it('doubles quotes so a value cannot break out of the literal', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE name = ?',
+      [`o'reilly'); DROP TABLE orders; --`],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE name = 'o''reilly''); DROP TABLE orders; --'`
+    );
+  });
+
+  it('keeps the literal closed for a backslash-then-quote payload', () => {
+    // In a backslash-escaping dialect `\'` would smuggle a quote through; on
+    // Dremio the backslash is data and only the quote needs doubling.
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE name = ?',
+      [`foo\\' OR 1=1 --`],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE name = 'foo\\'' OR 1=1 --'`);
+  });
+
+  it('keeps the literal closed for a value ending in a backslash', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE name = ? AND status = ?',
+      ['payload\\', 'new'],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE name = 'payload\\' AND status = 'new'`);
+  });
+
+  it('keeps a literal percent sign in an equality parameter verbatim', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE discount_label = ?',
+      ['100% cotton'],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE discount_label = '100% cotton'`);
+  });
+
+  it('escapes every element of an array parameter', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE status IN (?)',
+      [[`it's`, 'b']],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE status IN ('it''s', 'b')`);
+  });
+
+  it('substitutes multiple placeholders in order', () => {
+    const sql = applyParams(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER(?) || '%' ESCAPE '\\' AND status = ? AND amount > ?`,
+      ['pending\\_review', 'new', 100],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER('pending\\_review') || '%' ESCAPE '\\' AND status = 'new' AND amount > 100`
+    );
+  });
+});