Skip to content

Fix SQLiteException crash in MIGRATION_5_6 from unescaped apostrophes - #699

Merged
troymyree-lang merged 1 commit into
mainfrom
feature/698/fix-migration-5-6-sql-injection
Sep 1, 2026
Merged

Fix SQLiteException crash in MIGRATION_5_6 from unescaped apostrophes#699
troymyree-lang merged 1 commit into
mainfrom
feature/698/fix-migration-5-6-sql-injection

Conversation

@troymyree-lang

Copy link
Copy Markdown
Collaborator

Summary

  • MIGRATION_5_6 built its Phrase_New/Category_New INSERT statements via raw string interpolation, so an apostrophe in user-generated text ("I'm hungry", "It's my turn") broke the SQL statement and threw SQLiteException inside Room's onUpgrade -- blocking the database, and the app, from ever opening for affected users
  • Switched both INSERT statements to parameterized queries (bind args instead of string interpolation), which also fixes a related defect where a null value was written as the literal string "null" instead of a true SQL NULL
  • Added a regression test seeding a v5 database with an apostrophe in both a user-generated phrase and a category name, confirming the migration now succeeds and the text round-trips correctly

Ticket

Closes #698

Type of Change

  • Bug fix
  • Tests

Testing

  • Unit tests added/updated
  • Integration tests added/updated
  • Manual testing performed

New instrumented test (migrate5to6_preservesApostropheInUserGeneratedText in MigrationTest.kt) wasn't run against a device/emulator locally (none available in this environment) -- it will run via Firebase Test Lab in CI along with the rest of androidTest. compileDebugKotlin, compileDebugAndroidTestKotlin, and testDebug (all JVM unit tests) verified passing locally.

Checklist

  • Tests pass locally (./gradlew testDebug)
  • No API keys or secrets in code
  • CLAUDE.md updated (if new pattern introduced) -- not needed, no new pattern introduced

MIGRATION_5_6 built its Phrase_New/Category_New INSERT statements via raw
string interpolation, so an apostrophe in user-generated text (e.g. "I'm
hungry") broke out of the SQL string literal and threw SQLiteException
inside Room's onUpgrade -- blocking the database, and the app, from ever
opening for affected users. Switched both inserts to parameterized queries.

Closes #698

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@troymyree-lang
troymyree-lang merged commit edefeff into main Sep 1, 2026
4 checks passed
@troymyree-lang
troymyree-lang deleted the feature/698/fix-migration-5-6-sql-injection branch September 1, 2026 13:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fix SQLiteException crash in MIGRATION_5_6 from unescaped apostrophes in user-generated text

1 participant