[BUG]: SQL queries fail for catalog names containing hyphens

[kir445]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When a Unity Catalog name contains hyphens (e.g., arc-dbx-uc-cdp), SQL queries executed through SQLWarehouse and UnityCatalog classes fail with parse errors. Databricks SQL interprets the hyphens as minus operators, causing statements like SHOW SCHEMAS IN arc-dbx-uc-cdp to fail.

This affects all SQL operations that reference the catalog by name: SHOW SCHEMAS, SHOW TABLES, DESCRIBE, information_schema queries, and SHOW VOLUMES.

Expected Behavior

Catalog names containing hyphens should be automatically backtick-quoted so that SQL queries execute correctly. For example, SHOW SCHEMAS IN arc-dbx-uc-cdp should become SHOW SCHEMAS IN arc-dbx-uc-cdp``.

Steps To Reproduce

1. Configure OntoBricks to connect to a Databricks workspace
2. Have a Unity Catalog with a hyphenated name (e.g., arc-dbx-uc-cdp)
3. Browse schemas or tables for that catalog through the OntoBricks UI
4. SQL queries fail because the catalog name is not backtick-quoted

Cloud

Azure

Browser

Chrome

OntoBricks Version

0.5.2

Relevant log output

Additional Context

No response

[benoitcayladbx]

Analysis

Confirmed, and the root cause is exactly as described. Some notes on where the fix stands.

This is already fixed on develop (targeting 0.7.0), but not in any 0.6.x release.

The fix landed in b17c618 "fix(security): harden Unity Catalog SQL against identifier injection" (2026-07-05), which introduced a central identifier module with:

• validate_uc_identifier() — allows letters, digits, underscore and hyphen (^[a-zA-Z_][a-zA-Z0-9_-]*$), rejecting --
• quote_uc_identifier() / quote_uc_fqn() — backtick-quote the validated segments

Every SQL path listed in this report now routes through those helpers: SHOW SCHEMAS (get_schemas), SHOW TABLES (get_tables), SHOW VOLUMES (get_volumes), DESCRIBE (get_table_columns), the SELECT … LIMIT 0 probe (check_table_select_permission), and the three information_schema queries (list_functions, probe_schema_has_tables, get_table_comment). The information_schema ones additionally pass the schema/table name as a bound parameter for the WHERE predicate, which is the correct split between identifier and value. SQLWarehouse._create_or_replace builds its FQN with backticks as well.

The REST-based methods (list_tables_and_views, check_schema_access, check_volume_access, list_volumes, create_volume) pass the catalog as a URL path or query parameter, where hyphens need no quoting.

Why 0.6.x is unaffected by the fix: the 0.6 release line diverged from develop at ea6ce28 on 2026-07-03 — two days before the fix landed. So although v0.6.3 is tagged later (2026-07-16), it does not contain it, and still has the raw interpolation:

cur.execute(f"SHOW SCHEMAS IN {catalog}")
cur.execute(f"SHOW TABLES IN {catalog}.{schema}")
cur.execute(f"SHOW VOLUMES IN {catalog}.{schema}")
cur.execute(f"DESCRIBE {catalog}.{schema}.{table}")

Practically: upgrading from 0.5.2 to any current 0.6.x will not resolve this for arc-dbx-uc-cdp. A backport onto the 0.6.3 branch is being prepared so the fix ships in 0.6.4.

One behavioural caveat worth flagging: the validation regex requires a leading letter or underscore, so a catalog whose name starts with a digit will now raise a ValidationError instead of a SQL parse error. Unity Catalog does permit such names when quoted, so that's a narrow edge case the hardening traded away. Not what this issue reports, but relevant if a similar one appears.

[benoitcayladbx]

Backport for the 0.6 line is open as #125 (base 0.6.3), with regression tests covering arc-dbx-uc-cdp across SHOW SCHEMAS / SHOW TABLES / SHOW VOLUMES / DESCRIBE / the SELECT probe and the information_schema count.

Labelling status: Solved since the fix is in develop (per our convention). To be explicit about what that means for users: it ships in 0.7.0, and in 0.6.x only once #125 merges and a 0.6.4 is cut. Anyone on 0.5.2 or 0.6.x today still needs one of those.

[benoitcayladbx]

Backport for the 0.6 line is open as #125 (base 0.6.3), with regression tests covering arc-dbx-uc-cdp across SHOW SCHEMAS / SHOW TABLES / SHOW VOLUMES / DESCRIBE / the SELECT probe and the information_schema count.

Labelling status: Solved since the fix is in develop (per our convention). To be explicit about what that means for users: it ships in 0.7.0, and in 0.6.x only once #125 merges and a 0.6.4 is cut. Anyone on 0.5.2 or 0.6.x today still needs one of those.