BUG: Dynamically created table names allow SQL injection

[artemyk]

Working with the SQL code, I realized that the legacy code does not properly validate / escape passed in table and column names.

E.g.:

n [116]:

import pandas as pd
import pandas.io.sql as sql
import sqlite3

df = pd.DataFrame({'a':[1,2],'b':[2,3]})
con = sqlite3.connect(':memory:')
db = sql.SQLiteDatabase(con, 'sqlite')

t=sql.SQLiteTable('a; DELETE FROM contacts; INSERT INTO b', db, frame=df)

print t.insert_statement()

results in:

INSERT INTO a; DELETE FROM contacts; INSERT INTO b ([index],[a],[b]) VALUES (?,?,?)

This fixes the issues.

[artemyk]

@jorisvandenbossche Is there anything else that should be done here?

[artemyk]

Also, @jorisvandenbossche --- this is now failing tests because of the rather brittle _get_sqlite_column_type inserted in #9109 . Is there a reason you are parsing the sql code directly instead of inserting the table and then reading out the column type from PRAGMA (as done by existing _get_sqlite_column_type)?

[jorisvandenbossche]

@artemyk Hmm, I was first using the existing _get_sqlite_column_type, but then wrote that new function because I wanted to mimic the same test in the TestSQLApi (so just testing the type mapping that happens in SQLTable without the roundtrip to the actual database, so testing _sqlalchemy_type/_sql_type_name for sqlalchemy/fallback mode). But I agree it is rather brittle and not very good practice.
You can easily update it so the tests pass (I assume changing the '[]' to '""' would be enough), but I can also change the test.

[artemyk]

@jorisvandenbossche I changed the test to '""' so that it passes now and this can be merged. Personally I think a roundtrip to sqlite is better than a brittle test, so I would vote for changing it (I can do it in this PR if you'd like)

[artemyk]

@jorisvandenbossche Can we merge?

[jorisvandenbossche]

should this catch a UnicodeDecodeError? (better not have bare excepts)

[artemyk]

@jorisvandenbossche Now catching UnicodeError...

[jorisvandenbossche]

@artemyk Thanks!