fix: strip the table prefix correctly when rebuilding a SQLite3 table - #10509
Open
karlgray wants to merge 2 commits into
Open
fix: strip the table prefix correctly when rebuilding a SQLite3 table#10509karlgray wants to merge 2 commits into
karlgray wants to merge 2 commits into
Conversation
SQLite cannot alter or drop a column in place, so `SQLite3\Table` rebuilds the whole table and recreates its foreign keys from the metadata it collected. That metadata holds prefixed table names, and `createTable()` stripped the prefix with `trim($name, $this->db->DBPrefix)`. `trim()`'s second argument is a set of characters, not a prefix. It removes any of those characters from either end of the string, repeatedly, so with the prefix `db_` it turns `db_bandit_fk` into `andit_fk` — the leading `b` of the table's own name is eaten as well, and characters are stripped from the end too. The rebuilt table's foreign keys then reference tables that do not exist. Nothing fails at that point, because foreign key enforcement is off for the duration of the rebuild; the error surfaces at the next write to the referenced table, naming a table that appears nowhere in the schema. Whether a given table is affected depends on which characters its name happens to begin and end with, so most tables come through untouched. Strip the prefix the way `fromTable()` in the same class already does. The existing tests could not catch this: `AlterTableTest` builds its own connection without a `DBPrefix`, and the damage is invisible until the constraint is used. The regression test therefore sets a prefix and names the referenced table so that it begins with a character the prefix also contains, which is what makes the bug reproduce.
|
Hi there, karlgray! 👋 Thank you for sending this PR! We expect the following in all Pull Requests (PRs).
Important We expect all code changes or bug-fixes to be accompanied by one or more tests added to our test suite to prove the code works. If pull requests do not comply with the above, they will likely be closed. Since we are a team of volunteers, we don't have any more time to work See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md Sincerely, the mergeable bot 🤖 |
michalsn
approved these changes
Sep 1, 2026
michalsn
left a comment
Member
There was a problem hiding this comment.
Overall, it looks good. Thank you!
Co-authored-by: Michal Sniatala <michal@sniatala.pl>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #10508
SQLite cannot alter or drop a column in place, so
SQLite3\Tablerebuilds the whole table and recreates its foreign keys from the metadata it collected. That metadata holds prefixed table names, andcreateTable()stripped the prefix withtrim($name, $this->db->DBPrefix).trim()'s second argument is a set of characters, not a prefix. It removes any of those characters from either end of the string, repeatedly, so with the prefixdb_it turnsdb_bandit_fkintoandit_fk— the leadingbof the table's own name is eaten as well, and characters are stripped from the end too.The rebuilt table's foreign keys then reference tables that do not exist. Nothing fails at that point, because foreign key enforcement is off for the duration of the rebuild; the error surfaces at the next write to the referenced table, naming a table that appears nowhere in the schema. Whether a given table is affected depends on which characters its name happens to begin and end with, so most tables come through untouched.
Strip the prefix the way
fromTable()in the same class already does.The existing tests could not catch this:
AlterTableTestbuilds its own connection without aDBPrefix, and the damage is invisible until the constraint is used. The regression test therefore sets a prefix and names the referenced table so that it begins with a character the prefix also contains, which is what makes the bug reproduce.Description
Explain what you have changed, and why.
Checklist: