Add SQLite database preview support to Peek

[thomastv]

Summary of the Pull Request

This PR adds SQLite database file preview support to the Peek utility, resolving issue #45757 . Three new model classes (SQLiteTableInfo, SQLiteColumnInfo, ISQLitePreviewer) and a core SQLitePreviewer class were added to read .db, .sqlite, and .sqlite3 files read-only using Microsoft.Data.Sqlite, fetching table schema via PRAGMA table_info and up to 200 rows per table. A new SQLiteControl XAML control presents the data in a two-pane layout — a tree view listing all tables on the left and a data grid showing columns and rows on the right, with intelligent column sizing that stretches the last column when space allows and falls back to horizontal scrolling for wide tables. The previewer was wired into the existing previewerFactory and FilePreview host, and three localizable strings were added to Resources.resw.

PR Checklist

• Closes: Feature Request: Add SQLite (.db) File Preview Support to Peek #45757

• Communication: I've discussed this with core contributors already. If the work hasn't been agreed, this work might be rejected
• Tests: Added/updated and all pass
• Localization: All end-user-facing strings can be localized
• Dev docs: Added/updated
• New binaries: Added on the required places
  • JSON for signing for new binaries
  • WXS for installer for new binaries and localization folder
  • YML for CI pipeline for new test projects
  • YML for signed pipeline
• Documentation updated: If checked, please file a pull request on our docs repo and link it here: #xxx

Detailed Description of the Pull Request / Additional comments

• Added the new SQLiteControl user control (SQLiteControl.xaml and SQLiteControl.xaml.cs) for visualizing SQLite database tables, columns, and data in a split-pane UI with a DataGrid and tree view.
• Implemented supporting model classes: SQLiteTableInfo for table metadata and rows, and SQLiteColumnInfo for column details and display formatting.
• Defined the ISQLitePreviewer interface for previewer implementations that expose SQLite table data and metadata.
• Added the SQLitePreviewer to the previewer factory logic, enabling automatic detection and previewing of SQLite files.

Validation Steps Performed

1. Verified that the new feature works locally
2. Verified that the existing features are also working correctly after adding new changes
3. Created a dummy .db file and verified that the default fallback screen appears, since it isn't a valid sqlite file

[thomastv]

@jiripolasek,
Hi, could you please review the changes in this PR when you have a moment?
I’d appreciate any guidance or suggestions for improvement.

[MuyuanMS]

Code Review Suggestions

After thorough review (including iterative Copilot code review on a fork), I've identified several issues ranging from a high-severity SQL injection vulnerability to UX improvements. The suggestions below are ordered by severity and are designed to be self-contained — each can be committed independently via the "Commit suggestion" button.

Summary of Issues

#	Issue	Severity	File
1	SQL identifier injection via bracket-quoting	High	SQLitePreviewer.cs
2	WinUI binding path fails for column names with special chars	Medium	SQLiteControl.xaml.cs
3	Misleading row count when table data is truncated	Medium	SQLiteControl.xaml.cs
4	Key collision when distinct column names sanitize to the same string	Medium	SQLiteColumnInfo.cs

Recommended approach: Add a new SQLiteHelpers.cs file (suggested in comment 1) that centralizes SQL quoting and binding key management, then update the existing files to use it.

All changes have been verified to compile and function correctly with the Peek module.

[MuyuanMS]

Same bracket-quoting vulnerability as above. Replace with double-quote escaping:

Suggested change

	cmd.CommandText = $"SELECT COUNT(*) FROM [{tableName}];";
	cmd.CommandText = $"SELECT COUNT(*) FROM \"{tableName.Replace("\"", "\"\"")}\";";

[MuyuanMS]

Same bracket-quoting vulnerability. Replace with double-quote escaping:

Suggested change

	cmd.CommandText = $"SELECT * FROM [{tableName}] LIMIT 200;";
	cmd.CommandText = $"SELECT * FROM \"{tableName.Replace("\"", "\"\"")}\" LIMIT 200;";

[MuyuanMS]

WinUI binding path fails for column names with special characters (Medium Severity)

The binding path $"[{col.Name}]" uses WinUI's indexer syntax to access dictionary keys. If a column name contains characters special to PropertyPath (., [, ], /), the binding silently fails and the DataGrid shows empty cells for that column.

Similarly, the row dictionary (lines 119–124) uses raw column names as keys. If two distinct column names sanitize to the same key (e.g., a.b and a_b both become a_b), one value overwrites the other.

Recommended fix: Add a BindingKey property to SQLiteColumnInfo and a collision-safe key assignment step:

1. In SQLiteColumnInfo.cs, add:

public string BindingKey { get; set; } = string.Empty;

2. After loading columns, call a helper that sanitizes and deduplicates:

// Replaces .[]/  with _ and appends suffix on collision
SQLiteHelpers.AssignBindingKeys(tableInfo.Columns);

3. Then here, use col.BindingKey instead of col.Name:

Suggested change

	{
	TableDataGrid.Columns.Add(new DataGridTextColumn
	TableDataGrid.Columns.Add(new DataGridTextColumn
	{
	Header = col.Name,
	Binding = new Binding { Path = new PropertyPath($"[{col.BindingKey}]") },
	IsReadOnly = true,
	});

4. And in SQLitePreviewer.cs (line 122), use col.BindingKey for the row dictionary key too:

var col = tableInfo.Columns[i];
row[col.BindingKey] = reader.IsDBNull(i) ? null : reader.GetValue(i)?.ToString();

[thomastv]

Added a BindingKey property to SQLiteColumnInfo. The new SQLiteHelpers.AssignBindingKeys() method safely sanitizes column names containing special characters (like ., [, ], /) and handles suffix collisions. Both the row dictionary and the DataGrid bindings now safely use BindingKey.

[MuyuanMS]

Misleading row count when table data is truncated (Medium Severity)

The record count display shows the total row count from COUNT(*) (e.g., "Records: 5000"), but the DataGrid only shows up to 200 rows due to the LIMIT 200 in the query. Users see "Records: 5000" but can only scroll through 200 rows, with no indication the view is truncated.

Fix: Conditionally format the string to indicate truncation when table.RowCount > table.Rows.Count:

Suggested change

	// so ActualWidth values are valid when we decide whether to stretch the last column.
	TableDataGrid.DispatcherQueue.TryEnqueue(DispatcherQueuePriority.Low, AdjustLastColumnWidth);
	RecordCountText.Text = string.Format(
	RecordCountText.Text = table.RowCount > table.Rows.Count
	? string.Format(
	CultureInfo.CurrentCulture,
	ResourceLoaderInstance.ResourceLoader.GetString("SQLite_Row_Count_Truncated"),
	table.Rows.Count,
	table.RowCount)
	: string.Format(
	CultureInfo.CurrentCulture,
	ResourceLoaderInstance.ResourceLoader.GetString("SQLite_Row_Count"),
	table.RowCount);

This requires a new resource string in Resources.resw:

<data name="SQLite_Row_Count_Truncated" xml:space="preserve">
  <value>Records: {0} of {1}</value>
  <comment>{0} is the number of rows shown (limited), {1} is the total row count</comment>
</data>

This way users see "Records: 200 of 5000" making it clear the view is limited.

[thomastv]

Thank you for the suggestion. Added conditional formatting in SQLiteControl.xaml.cs to explicitly show when the table view is truncated. When the total row count exceeds the preview limit, the UI now displays "Records: {shown} of {total}" using the newly added SQLite_Row_Count_Truncated resource string.

[MuyuanMS]

Add BindingKey property for safe WinUI data binding

To support the binding path fix (see comment on SQLiteControl.xaml.cs), this model needs a BindingKey property. It stores the sanitized, collision-safe key used by both the row dictionary and the DataGrid binding path. The key is computed after all columns are loaded so that duplicate detection can append numeric suffixes (e.g., a_b → a_b_2).

Suggested change

	public bool IsNotNull { get; set; }
	public bool IsNotNull { get; set; }
	/// <summary>
	/// Sanitized key used for WinUI binding paths and row dictionary keys.
	/// Computed after all columns are loaded to handle potential collisions.
	/// </summary>
	public string BindingKey { get; set; } = string.Empty;

[thomastv]

Added

[MuyuanMS]

Use column's BindingKey for row dictionary keys

The row dictionary keys must match the PropertyPath used in the DataGrid binding. Currently both use the raw column name, which breaks for special characters. After adding BindingKey to SQLiteColumnInfo and computing it with collision detection (via AssignBindingKeys()), use it here:

Suggested change

	var row = new Dictionary<string, string?>(reader.FieldCount, StringComparer.Ordinal);
	for (int i = 0; i < reader.FieldCount; i++)
	{
	row[reader.GetName(i)] = reader.IsDBNull(i) ? null : reader.GetValue(i)?.ToString();
	}
	var row = new Dictionary<string, string?>(reader.FieldCount, StringComparer.Ordinal);
	for (int i = 0; i < reader.FieldCount; i++)
	{
	var col = tableInfo.Columns[i];
	row[col.BindingKey] = reader.IsDBNull(i) ? null : reader.GetValue(i)?.ToString();
	}

This ensures the DataGrid can always find the correct value regardless of what characters appear in the original column name.

[thomastv]

Thanks, updated the relevant code

[MuyuanMS]

Can you remind me why you changed .yml workflows in .github/workflows in your last change? If it's about spell checks, iirc all you need to do is to add the patterns into according files to exclude them.

[thomastv]

Can you remind me why you changed .yml workflows in .github/workflows in your last change? If it's about spell checks, iirc all you need to do is to add the patterns into according files to exclude them.

Sorry those files were changed when I synced the main branch, I have reverted it back