sqlcipher_export() fails for a quoted target schema and leaves a persistent partial export #609

Version and environment

Reproduced on SQLCipher commit 810db22f575ee7cf94ea96a3e91622b5fcece3dc on Linux amd64. Runtime: SQLite 3.53.3 / SQLCipher 4.17.0 Community.

Describe the bug

When the valid target schema alias is "target-db", sqlcipher_export() successfully creates target schema objects, then generates an unquoted INSERT INTO target-db... statement and fails at the hyphen. The target file remains on disk with the source table but none of its rows. A normal targetdb control exports the row completely.

Minimal reproduction

bash sqlcipher-027-sqlcipher-export-fails-and-partially-exports-when-atta-02123c9e/poc/revalidate_sqlcipher_027.sh

The essential SQL is:

PRAGMA key='main-key';
CREATE TABLE src_t(a INTEGER PRIMARY KEY, b TEXT);
INSERT INTO src_t VALUES(1, 'alpha');
ATTACH DATABASE '/work/c027-hyphen-target.db' AS "target-db";
PRAGMA "target-db".key='target-key';
SELECT sqlcipher_export('target-db');
SELECT count(*) FROM "target-db".sqlite_schema WHERE name='src_t';
SELECT count(*) FROM "target-db".src_t;

Detach, attach /work/c027-hyphen-target.db again under a normal alias with target-key, and repeat the last two checks.

Actual behavior/output

control_rows|1|alpha
hyphen_attached|target-db
during_schema_tables|1|src_t
during_rows|0
reopen_schema_tables|1|src_t
reopen_rows|0
Error near line 18: near "-": syntax error
run.exit=1

Expected behavior

A valid quoted target alias should receive the complete export. If export fails, it should not silently leave a target whose schema suggests success but whose table data was never copied.

Impact and scope

The caller receives an error, but a persistent partial database remains. Downstream code that discovers tables or retries against the file can mistake it for a complete export, risking incomplete backups or migrations.

Relevant source/root cause

The schema-copy stage around src/sqlcipher.c:4002-4025 succeeds for source main, creating src_t. The data-copy SQL around :4031-4037 uses raw %s for the target schema, so target-db becomes invalid syntax. Additional raw formatting appears around :4044 and :4058.

Suggested regression test

Export a one-row table to an attached database named "target-db"; verify both schema and row after reopen. Also inject a later-stage export failure and assert either transaction rollback/cleanup or a clearly documented, detectable partial-result contract.

Reproduction bundle

Attached: sqlcipher-027-sqlcipher-export-fails-and-partially-exports-when-atta-02123c9e_attachment.zip. It contains the focused PoC, validation evidence, and candidate metadata.

sqlcipher-027-sqlcipher-export-fails-and-partially-exports-when-atta-02123c9e_attachment.zip