codeigniter4 / CodeIgniter4 / 33970927193

90%

push

github

fix: strip the table prefix correctly when rebuilding a SQLite3 table (#10509)

SQLite cannot alter or drop a column in place, so `SQLite3\Table` rebuilds
the whole table and recreates its foreign keys from the metadata it
collected. That metadata holds prefixed table names, and `createTable()`
stripped the prefix with `trim($name, $this->db->DBPrefix)`.

`trim()`'s second argument is a set of characters, not a prefix. It removes
any of those characters from either end of the string, repeatedly, so with
the prefix `db_` it turns `db_bandit_fk` into `andit_fk` — the leading `b`
of the table's own name is eaten as well, and characters are stripped from
the end too.

The rebuilt table's foreign keys then reference tables that do not exist.
Nothing fails at that point, because foreign key enforcement is off for the
duration of the rebuild; the error surfaces at the next write to the
referenced table, naming a table that appears nowhere in the schema. Whether
a given table is affected depends on which characters its name happens to
begin and end with, so most tables come through untouched.

Strip the prefix the way `fromTable()` in the same class already does.

The existing tests could not catch this: `AlterTableTest` builds its own
connection without a `DBPrefix`, and the damage is invisible until the
constraint is used. The regression test therefore sets a prefix and names
the referenced table so that it begins with a character the prefix also
contains, which is what makes the bug reproduce.

5 of 5 new or added lines in 1 file covered. (100.0%)

22625 of 25129 relevant lines covered (90.04%)

215.86 hits per line