From 40c00bca7bbde83e9435df5e05f2c966e64c406f Mon Sep 17 00:00:00 2001 From: Paul Trowbridge Date: Wed, 17 Jun 2026 15:20:30 -0400 Subject: [PATCH] web: quote wizard source-query aliases with the source dialect MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wizard_create built the generated source query's column aliases with the DEST driver's quote_identifier, but that query runs on the SOURCE. A pg->SQL Server module emitted "AS [col]" (SQL Server brackets) into a Postgres query, which failed with: syntax error at or near "[". The load maps columns by position, so the alias is cosmetic — quote it with the source dialect. Co-Authored-By: Claude Opus 4.8 --- pipekit/web/app.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pipekit/web/app.py b/pipekit/web/app.py index 3174ab0..e8f227c 100644 --- a/pipekit/web/app.py +++ b/pipekit/web/app.py @@ -724,9 +724,13 @@ async def wizard_create(request: Request): raise HTTPException(400, "no columns selected") qualified_source = src_drv.qualified_table_name(table, **qvals) + # Alias quoting must use the SOURCE dialect — this query runs on the + # source. (The load maps columns by position, so the alias is cosmetic; + # using dest quoting here leaked e.g. SQL Server [brackets] into a + # Postgres source query.) select_list = ",\n ".join( f"{src_drv.default_expression(c['source_type'], c['source_name'])} AS " - f"{dest_drv.quote_identifier(c['dest_name'])}" + f"{src_drv.quote_identifier(c['dest_name'])}" for c in chosen ) source_query_override = (form.get("source_query") or "").strip()