Fix SQL injection in Schema::findViewNames()

[darkspock]

Summary

Schema::findViewNames() interpolates the $schema parameter directly into a SQL heredoc string:

SELECT table_name FROM information_schema.tables
WHERE table_type = 'VIEW' AND table_schema = '$schema'
order by table_name

This is a SQL injection risk. While $schema typically comes from configuration rather than user input, this is inconsistent with the rest of the codebase where all other methods in this file use either parameterized queries or proper quoting:

• findTableComment() (line 164): uses :schemaName bound parameter
• findTableNames() (line 181): uses quoteSimpleTableName()
• loadTableConstraints(), loadTableIndexes(), etc.: all use :schemaName

Fix

Replace direct string interpolation with a :schemaName bound parameter, consistent with findTableComment() and other methods in the same file.

Before

default => <<<SQL
SELECT table_name FROM information_schema.tables
WHERE table_type = 'VIEW' AND table_schema = '$schema'
order by table_name
SQL,

After

default => <<<SQL
SELECT table_name FROM information_schema.tables
WHERE table_type = 'VIEW' AND table_schema = :schemaName
order by table_name
SQL,

Risk

Very low — this is a direct replacement of string interpolation with parameter binding. The query behavior is identical.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.84%. Comparing base (c9898f4) to head (af0212f).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #463      +/-   ##
============================================
+ Coverage     98.73%   98.84%   +0.11%     
- Complexity      255      256       +1     
============================================
  Files            24       24              
  Lines           790      779      -11     
============================================
- Hits            780      770      -10     
+ Misses           10        9       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Tigrov]

Needs line to changelog

[Tigrov]

It is better to combine two identical checks into one.

[vjik]

There are different conditions in SQL: table_schema != 'sys' and table_schema = :schemaName.

[vjik]

I suggest refactor code to:

if ($schema === '') {
    $sql = ...
    $params = ...
} else {
    $sql = ...
    $params = ...
}

I think it will be more clear.

[Tigrov]

if ($schema === '') {
    $sql = ...
    $params = ...
} else {
    $sql = ...
    $params = ...
}

That's what I meant.

[Copilot]

Pull request overview

This PR addresses a SQL injection risk in the MySQL/MariaDB schema introspection layer by replacing direct string interpolation in Schema::findViewNames() with a bound parameter, aligning the implementation with other schema metadata queries in the same class.

Changes:

• Replace $schema string interpolation in the information_schema.tables query with a :schemaName bound parameter.
• Pass bound parameters to createCommand() when a non-empty schema is provided.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Tigrov]

👍