@cubejs-backend/dremio-driver 1.6.68 → 1.6.70

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.6.70](https://github.com/cube-js/cube/compare/v1.6.69...v1.6.70) (2026-07-28)
+
+### Bug Fixes
+
+- **pinot/dremio/ksql/databriks/hive/jdbc-driver:** Сorrect SQL parameter escaping ([#11374](https://github.com/cube-js/cube/issues/11374)) ([e77c444](https://github.com/cube-js/cube/commit/e77c44471a720d31b29c7741a8a6040ec5836739))
+
+## [1.6.69](https://github.com/cube-js/cube/compare/v1.6.68...v1.6.69) (2026-07-10)
+
+**Note:** Version bump only for package @cubejs-backend/dremio-driver
+
 ## [1.6.68](https://github.com/cube-js/cube/compare/v1.6.67...v1.6.68) (2026-07-07)
 
 **Note:** Version bump only for package @cubejs-backend/dremio-driver

package/driver/DremioDriver.js

@@ -7,10 +7,10 @@
 const {
   getEnv,
   assertDataSource,
+  formatAnsi,
   pausePromise,
 } = require('@cubejs-backend/shared');
 const axios = require('axios');
-const SqlString = require('sqlstring');
 const { BaseDriver } = require('@cubejs-backend/base-driver');
 const DremioQuery = require('./DremioQuery');
 
@@ -18,7 +18,7 @@ const DremioQuery = require('./DremioQuery');
 // @see https://docs.dremio.com/rest-api/jobs/get-job.html
 const DREMIO_JOB_LIMIT = 500;
 
-const applyParams = (query, params) => SqlString.format(query, params);
+const applyParams = (query, params) => formatAnsi(query, params);
 
 /**
  * Dremio driver class.
@@ -208,12 +208,7 @@ class DremioDriver extends BaseDriver {
   }
 
   async query(query, values) {
-    const queryString = applyParams(
-      query,
-      (values || []).map(s => (typeof s === 'string' ? {
-        toSqlString: () => SqlString.escape(s).replace(/\\\\([_%])/g, '\\$1').replace(/\\'/g, '\'\'')
-      } : s))
-    );
+    const queryString = applyParams(query, values || []);
 
     await this.getToken();
     const jobId = await this.executeQuery(queryString);
@@ -281,3 +276,4 @@ class DremioDriver extends BaseDriver {
 }
 
 module.exports = DremioDriver;
+module.exports.applyParams = applyParams;

package/package.json

@@ -2,7 +2,7 @@
   "name": "@cubejs-backend/dremio-driver",
   "description": "Cube.js Dremio driver",
   "author": "Cube Dev, Inc.",
-  "version": "1.6.68",
+  "version": "1.6.70",
   "repository": {
     "type": "git",
     "url": "https://github.com/cube-js/cube.git",
@@ -16,21 +16,21 @@
     "tsc": "tsc",
     "watch": "tsc -w",
     "test": "yarn integration",
+    "unit": "jest --verbose dist/test/unit",
     "integration": "npm run integration:dremio",
     "integration:dremio": "jest --verbose dist/test",
     "lint": "eslint driver/*.js",
     "lint:fix": "eslint driver/*.js"
   },
   "dependencies": {
-    "@cubejs-backend/base-driver": "1.6.68",
-    "@cubejs-backend/schema-compiler": "1.6.68",
-    "@cubejs-backend/shared": "1.6.68",
-    "axios": "^1.8.3",
-    "sqlstring": "^2.3.1"
+    "@cubejs-backend/base-driver": "1.6.70",
+    "@cubejs-backend/schema-compiler": "1.6.70",
+    "@cubejs-backend/shared": "1.6.70",
+    "axios": "^1.8.3"
   },
   "devDependencies": {
-    "@cubejs-backend/linter": "1.6.68",
-    "@cubejs-backend/testing-shared": "1.6.68",
+    "@cubejs-backend/linter": "1.6.70",
+    "@cubejs-backend/testing-shared": "1.6.70",
     "jest": "^29"
   },
   "license": "Apache-2.0",
@@ -40,5 +40,5 @@
   "eslintConfig": {
     "extends": "../cubejs-linter"
   },
-  "gitHead": "435758923587de1d12e61974984d3c469f02c8dc"
+  "gitHead": "e6666359d37b223362d83cf745bcd0a1c1fdf4b2"
 }

package/test/unit/params-escaping.test.ts

@@ -0,0 +1,88 @@
+/* eslint-disable quotes */
+const { applyParams } = require('../../../driver/DremioDriver');
+
+// Dremio is a Calcite-based, standard-SQL engine: a quote inside a string
+// literal is escaped by doubling it and a backslash is plain data.
+describe('DremioDriver SQL parameter escaping', () => {
+  it('preserves LIKE escape sequences emitted by the schema compiler', () => {
+    const sql = applyParams(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER(?) || '%' ESCAPE '\\'`,
+      ['new\\_order\\%'],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER('new\\_order\\%') || '%' ESCAPE '\\'`
+    );
+  });
+
+  it('does not double literal backslashes in LIKE parameters', () => {
+    const sql = applyParams(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER(?) || '%' ESCAPE '\\'`,
+      ['folder\\\\name'],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER('folder\\\\name') || '%' ESCAPE '\\'`
+    );
+  });
+
+  it('doubles quotes so a value cannot break out of the literal', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE name = ?',
+      [`o'reilly'); DROP TABLE orders; --`],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE name = 'o''reilly''); DROP TABLE orders; --'`
+    );
+  });
+
+  it('keeps the literal closed for a backslash-then-quote payload', () => {
+    // In a backslash-escaping dialect `\'` would smuggle a quote through; on
+    // Dremio the backslash is data and only the quote needs doubling.
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE name = ?',
+      [`foo\\' OR 1=1 --`],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE name = 'foo\\'' OR 1=1 --'`);
+  });
+
+  it('keeps the literal closed for a value ending in a backslash', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE name = ? AND status = ?',
+      ['payload\\', 'new'],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE name = 'payload\\' AND status = 'new'`);
+  });
+
+  it('keeps a literal percent sign in an equality parameter verbatim', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE discount_label = ?',
+      ['100% cotton'],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE discount_label = '100% cotton'`);
+  });
+
+  it('escapes every element of an array parameter', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE status IN (?)',
+      [[`it's`, 'b']],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE status IN ('it''s', 'b')`);
+  });
+
+  it('substitutes multiple placeholders in order', () => {
+    const sql = applyParams(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER(?) || '%' ESCAPE '\\' AND status = ? AND amount > ?`,
+      ['pending\\_review', 'new', 100],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER('pending\\_review') || '%' ESCAPE '\\' AND status = 'new' AND amount > 100`
+    );
+  });
+});