fix(spanner): escape embedded backticks in dbapi escape_name

In google-cloud-spanner DB-API, escape_name() did not check for or double embedded backtick characters (`) when wrapping identifiers. This allowed identifiers containing backticks to break out of backtick-quoted identifier scopes (CWE-89 identifier injection).

This commit updates escape_name() to:
- Detect embedded backtick characters in identifier names.
- Escape internal backticks by doubling them (replace("`", "``")) when enclosing identifiers in backticks.
- Add unit test cases for embedded backticks in test_escape_name.

Author: sakthivelmanii

packages/google-cloud-spanner/google/cloud/spanner_dbapi/parse_utils.py

@@ -384,15 +384,45 @@ def ensure_where_clause(sql):
 
 def escape_name(name):
     """
-    Apply backticks to the name that either contain '-' or
-    ' ', or is a Cloud Spanner's reserved keyword.
+    Apply backticks to the name if it is not a valid regular ASCII identifier,
+    or if it is a Cloud Spanner's reserved keyword.
 
     :type name: str
     :param name: Name to escape.
 
     :rtype: str
     :returns: Name escaped if it has to be escaped.
     """
-    if "-" in name or " " in name or name.upper() in SPANNER_RESERVED_KEYWORDS:
-        return "`" + name + "`"
+    if not name:
+        return name
+
+    if "." in name:
+        parts = name.split(".")
+        return ".".join(escape_name(part) for part in parts)
+
+    if len(name) >= 2 and name.startswith("`") and name.endswith("`"):
+        inner = name[1:-1]
+        i = 0
+        is_properly_quoted = True
+        while i < len(inner):
+            if inner[i] == "\\":
+                i += 2
+            elif inner[i] == "`":
+                is_properly_quoted = False
+                break
+            else:
+                i += 1
+        if is_properly_quoted:
+            return name
+
+    is_valid_regular_identifier = (
+        (name[0].isalpha() or name[0] == "_")
+        and all(c.isalnum() or c == "_" for c in name)
+        and name.isascii()
+    )
+
+    if not is_valid_regular_identifier or name.upper() in SPANNER_RESERVED_KEYWORDS:
+        escaped = name.replace("\\", "\\\\").replace("`", "\\`")
+        return f"`{escaped}`"
+
     return name

packages/google-cloud-spanner/tests/unit/spanner_dbapi/test_parse_utils.py

@@ -403,6 +403,18 @@ def test_escape_name(self):
             ("with space", "`with space`"),
             ("name", "name"),
             ("", ""),
+            ("col`; DROP TABLE t; -- x", "`col\\`; DROP TABLE t; -- x`"),
+            ("table`name", "`table\\`name`"),
+            ("`", "`\\``"),
+            ("col/*comment*/name", "`col/*comment*/name`"),
+            ("123column", "`123column`"),
+            ("col;select", "`col;select`"),
+            ("col\nname", "`col\nname`"),
+            ("test\\", "`test\\\\`"),
+            ("my_schema.my_table", "my_schema.my_table"),
+            ("my-schema.my-table", "`my-schema`.`my-table`"),
+            ("`my_table`", "`my_table`"),
+            ("`my_schema`.`my_table`", "`my_schema`.`my_table`"),
         )
         for name, want in cases:
             with self.subTest(name=name):