@cubejs-backend/dremio-driver 1.7.11 → 1.7.13

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.7.13](https://github.com/cube-js/cube/compare/v1.7.12...v1.7.13) (2026-07-28)
+
+**Note:** Version bump only for package @cubejs-backend/dremio-driver
+
+## [1.7.12](https://github.com/cube-js/cube/compare/v1.7.11...v1.7.12) (2026-07-27)
+
+### Bug Fixes
+
+- **pinot/dremio/ksql/databriks/hive/jdbc-driver:** Сorrect SQL parameter escaping ([#11374](https://github.com/cube-js/cube/issues/11374)) ([a743790](https://github.com/cube-js/cube/commit/a7437904411cbf268a30bc985c6d5b3b8bbe0e2c))
+
 ## [1.7.11](https://github.com/cube-js/cube/compare/v1.7.8...v1.7.11) (2026-07-26)
 
 **Note:** Version bump only for package @cubejs-backend/dremio-driver

package/driver/DremioDriver.js

@@ -7,10 +7,10 @@
 const {
   getEnv,
   assertDataSource,
+  formatAnsi,
   pausePromise,
 } = require('@cubejs-backend/shared');
 const axios = require('axios');
-const SqlString = require('sqlstring');
 const { BaseDriver } = require('@cubejs-backend/base-driver');
 const DremioQuery = require('./DremioQuery');
 
@@ -18,7 +18,7 @@ const DremioQuery = require('./DremioQuery');
 // @see https://docs.dremio.com/rest-api/jobs/get-job.html
 const DREMIO_JOB_LIMIT = 500;
 
-const applyParams = (query, params) => SqlString.format(query, params);
+const applyParams = (query, params) => formatAnsi(query, params);
 
 /**
  * Dremio driver class.
@@ -208,12 +208,7 @@ class DremioDriver extends BaseDriver {
   }
 
   async query(query, values) {
-    const queryString = applyParams(
-      query,
-      (values || []).map(s => (typeof s === 'string' ? {
-        toSqlString: () => SqlString.escape(s).replace(/\\\\([_%])/g, '\\$1').replace(/\\'/g, '\'\'')
-      } : s))
-    );
+    const queryString = applyParams(query, values || []);
 
     await this.getToken();
     const jobId = await this.executeQuery(queryString);
@@ -281,3 +276,4 @@ class DremioDriver extends BaseDriver {
 }
 
 module.exports = DremioDriver;
+module.exports.applyParams = applyParams;

package/package.json

@@ -2,7 +2,7 @@
   "name": "@cubejs-backend/dremio-driver",
   "description": "Cube.js Dremio driver",
   "author": "Cube Dev, Inc.",
-  "version": "1.7.11",
+  "version": "1.7.13",
   "repository": {
     "type": "git",
     "url": "https://github.com/cube-js/cube.git",
@@ -16,21 +16,21 @@
     "tsc": "tsc",
     "watch": "tsc -w",
     "test": "yarn integration",
+    "unit": "jest --verbose dist/test/unit",
     "integration": "npm run integration:dremio",
     "integration:dremio": "jest --verbose dist/test",
     "lint": "eslint driver/*.js",
     "lint:fix": "eslint driver/*.js"
   },
   "dependencies": {
-    "@cubejs-backend/base-driver": "1.7.11",
-    "@cubejs-backend/schema-compiler": "1.7.11",
-    "@cubejs-backend/shared": "1.7.11",
-    "axios": "^1.8.3",
-    "sqlstring": "^2.3.1"
+    "@cubejs-backend/base-driver": "1.7.13",
+    "@cubejs-backend/schema-compiler": "1.7.13",
+    "@cubejs-backend/shared": "1.7.13",
+    "axios": "^1.8.3"
   },
   "devDependencies": {
-    "@cubejs-backend/linter": "1.7.11",
-    "@cubejs-backend/testing-shared": "1.7.11",
+    "@cubejs-backend/linter": "1.7.13",
+    "@cubejs-backend/testing-shared": "1.7.13",
     "jest": "^29"
   },
   "license": "Apache-2.0",
@@ -40,5 +40,5 @@
   "eslintConfig": {
     "extends": "../cubejs-linter"
   },
-  "gitHead": "911e38b02aaee9be361712e68e59a8728d643f1b"
+  "gitHead": "c05b9d2c94645c75b752d3e7058a7d6232dea621"
 }

package/test/unit/params-escaping.test.ts

@@ -0,0 +1,88 @@
+/* eslint-disable quotes */
+const { applyParams } = require('../../../driver/DremioDriver');
+
+// Dremio is a Calcite-based, standard-SQL engine: a quote inside a string
+// literal is escaped by doubling it and a backslash is plain data.
+describe('DremioDriver SQL parameter escaping', () => {
+  it('preserves LIKE escape sequences emitted by the schema compiler', () => {
+    const sql = applyParams(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER(?) || '%' ESCAPE '\\'`,
+      ['new\\_order\\%'],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER('new\\_order\\%') || '%' ESCAPE '\\'`
+    );
+  });
+
+  it('does not double literal backslashes in LIKE parameters', () => {
+    const sql = applyParams(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER(?) || '%' ESCAPE '\\'`,
+      ['folder\\\\name'],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER('folder\\\\name') || '%' ESCAPE '\\'`
+    );
+  });
+
+  it('doubles quotes so a value cannot break out of the literal', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE name = ?',
+      [`o'reilly'); DROP TABLE orders; --`],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE name = 'o''reilly''); DROP TABLE orders; --'`
+    );
+  });
+
+  it('keeps the literal closed for a backslash-then-quote payload', () => {
+    // In a backslash-escaping dialect `\'` would smuggle a quote through; on
+    // Dremio the backslash is data and only the quote needs doubling.
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE name = ?',
+      [`foo\\' OR 1=1 --`],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE name = 'foo\\'' OR 1=1 --'`);
+  });
+
+  it('keeps the literal closed for a value ending in a backslash', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE name = ? AND status = ?',
+      ['payload\\', 'new'],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE name = 'payload\\' AND status = 'new'`);
+  });
+
+  it('keeps a literal percent sign in an equality parameter verbatim', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE discount_label = ?',
+      ['100% cotton'],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE discount_label = '100% cotton'`);
+  });
+
+  it('escapes every element of an array parameter', () => {
+    const sql = applyParams(
+      'SELECT * FROM orders WHERE status IN (?)',
+      [[`it's`, 'b']],
+    );
+
+    expect(sql).toBe(`SELECT * FROM orders WHERE status IN ('it''s', 'b')`);
+  });
+
+  it('substitutes multiple placeholders in order', () => {
+    const sql = applyParams(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER(?) || '%' ESCAPE '\\' AND status = ? AND amount > ?`,
+      ['pending\\_review', 'new', 100],
+    );
+
+    expect(sql).toBe(
+      `SELECT * FROM orders WHERE LOWER(name) LIKE '%' || LOWER('pending\\_review') || '%' ESCAPE '\\' AND status = 'new' AND amount > 100`
+    );
+  });
+});