sqlcipher_export() fails for a valid attached schema name that requires identifier quoting #608

Version and environment

Reproduced on SQLCipher commit 810db22f575ee7cf94ea96a3e91622b5fcece3dc in Linux amd64. Runtime: SQLite 3.53.3 / SQLCipher 4.17.0 Community.

Describe the bug

SQLite accepts an attached schema named "target-db", and SQLCipher's schema lookup confirms it exists. sqlcipher_export() nevertheless inserts the name into generated SQL without identifier quoting. Export to a normal alias succeeds, while export to the legal hyphenated alias fails at - with a syntax error.

Minimal reproduction

bash sqlcipher-023-sqlcipher-export-does-not-quote-validated-attached-sch-e7d5ea64/poc/revalidate_sqlcipher_023.sh

The essential SQL is:

PRAGMA key='main-key';
CREATE TABLE t(id INTEGER PRIMARY KEY, value TEXT);
INSERT INTO t VALUES(1, 'alpha');
ATTACH DATABASE '/work/c023-hyphen-target.db' AS "target-db";
PRAGMA "target-db".key='target-key';
SELECT sqlcipher_export('target-db');
SELECT count(*) FROM "target-db".t;

The supplied control attaches the same kind of target as targetdb and runs the same export.

Actual behavior/output

The normal alias exports one row. For the quoted alias:

hyphen_attached|target-db
hyphen_table_count|1
hyphen_row_count|0
Error near line 19: near "-": syntax error
run.exit=1

Expected behavior

Every schema identifier accepted by SQLite's ATTACH ... AS syntax should be usable by sqlcipher_export(). The function should quote/escape the validated identifier and export the row without a syntax error.

Impact and scope

Applications using otherwise valid attached schema names containing hyphens or other quoting-requiring characters cannot export data through this function. This candidate is a correctness/compatibility bug for valid identifiers.

Relevant source/root cause

src/sqlcipher.c:3977-3990 validates source and target schema names. Code around :4002, :4031, :4044, and :4058 then uses raw %s in qualified schema/table expressions. By contrast, other SQLite paths in the tree use identifier-aware formatting such as %w.

Suggested regression test

Attach a destination as "target-db", export a one-row table, and assert that the row is present. Add aliases containing spaces and embedded double quotes to verify correct identifier escaping.

Reproduction bundle

Attached: sqlcipher-023-sqlcipher-export-does-not-quote-validated-attached-sch-e7d5ea64_attachment.zip. It contains the focused PoC, validation evidence, and candidate metadata.

sqlcipher-023-sqlcipher-export-does-not-quote-validated-attached-sch-e7d5ea64_attachment.zip