fix(sonar): S2083 path-traversal hardening, S2077 provider DDL parameterization, IN-predicate de-duplication

- TenantBackupRestoreService: BuildBackupPath now uses Path.GetFileName on tenant/database segments plus a backup-directory containment check; all path helpers normalize with Path.GetFullPath before filesystem access (S2083)

- SharpCoreDBTableBuilder: sqlite_master existence checks now use bound @name parameters; identifier-only DDL statements are annotated NOSONAR:S2077 with justification (whitelisted via SqlIdentifier.EnsureSafe)

- New shared SqlInPredicate helper centralizes IN/NOT IN parsing+eval across SingleFileTable, Table.EvaluateWhere and the AST evaluator (removes 3x duplicated value-list parsing)

Author: MPCoreDeveloper

.gitignore

@@ -421,3 +421,7 @@ packages/
 dist/
 *.tsbuildinfo
 .pytest_cache/
+
+# SonarScanner local analysis artifacts
+.sonarqube/
+.scannerwork/

src/SharpCoreDB.Provider.Sync/Builders/SharpCoreDBTableBuilder.cs

@@ -75,7 +75,11 @@ public override Task<DbCommand> GetExistsTableCommandAsync(DbConnection connecti
         var tableName = SqlIdentifier.EnsureSafe(_tableDescription.TableName, nameof(_tableDescription.TableName));
         var command = connection.CreateCommand();
         command.Transaction = transaction;
-        command.CommandText = $"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='{tableName}'";
+        command.CommandText = "SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name=@name";
+        var nameParam = command.CreateParameter();
+        nameParam.ParameterName = "@name";
+        nameParam.Value = tableName;
+        command.Parameters.Add(nameParam);
         return Task.FromResult(command);
     }
 
@@ -95,7 +99,7 @@ public override Task<DbCommand> GetDropTableCommandAsync(DbConnection connection
         var tableName = SqlIdentifier.EnsureSafe(_tableDescription.TableName, nameof(_tableDescription.TableName));
         var command = connection.CreateCommand();
         command.Transaction = transaction;
-        command.CommandText = $"DROP TABLE IF EXISTS [{tableName}]";
+        command.CommandText = $"DROP TABLE IF EXISTS [{tableName}]"; // NOSONAR:S2077 - {tableName} whitelisted via SqlIdentifier.EnsureSafe
         return Task.FromResult(command);
     }
 
@@ -105,7 +109,7 @@ public override Task<DbCommand> GetExistsColumnCommandAsync(string columnName, D
         var tableName = SqlIdentifier.EnsureSafe(_tableDescription.TableName, nameof(_tableDescription.TableName));
         var command = connection.CreateCommand();
         command.Transaction = transaction;
-        command.CommandText = $"PRAGMA table_info([{tableName}])";
+        command.CommandText = $"PRAGMA table_info([{tableName}])"; // NOSONAR:S2077 - {tableName} whitelisted via SqlIdentifier.EnsureSafe
         return Task.FromResult(command);
     }
 
@@ -167,7 +171,7 @@ public override Task<DbCommand> GetCreateTrackingTableCommandAsync(DbConnection
 
         var command = connection.CreateCommand();
         command.Transaction = transaction;
-        command.CommandText = $@"
+        command.CommandText = $@" // NOSONAR:S2077 - identifiers whitelisted via SqlIdentifier.EnsureSafe
             CREATE TABLE IF NOT EXISTS {trackingTableName} (
                 {pkColumn} {pkType} PRIMARY KEY NOT NULL,
                 update_scope_id TEXT,
@@ -185,7 +189,7 @@ public override Task<DbCommand> GetDropTrackingTableCommandAsync(DbConnection co
         var trackingTableName = $"{tableName}_tracking";
         var command = connection.CreateCommand();
         command.Transaction = transaction;
-        command.CommandText = $"DROP TABLE IF EXISTS [{trackingTableName}]";
+        command.CommandText = $"DROP TABLE IF EXISTS [{trackingTableName}]"; // NOSONAR:S2077 - {trackingTableName} whitelisted via SqlIdentifier.EnsureSafe
         return Task.FromResult(command);
     }
 
@@ -196,7 +200,11 @@ public override Task<DbCommand> GetExistsTrackingTableCommandAsync(DbConnection
         var trackingTableName = $"{tableName}_tracking";
         var command = connection.CreateCommand();
         command.Transaction = transaction;
-        command.CommandText = $"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='{trackingTableName}'";
+        command.CommandText = "SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name=@name";
+        var nameParam = command.CreateParameter();
+        nameParam.ParameterName = "@name";
+        nameParam.Value = trackingTableName;
+        command.Parameters.Add(nameParam);
         return Task.FromResult(command);
     }
 
@@ -214,7 +222,11 @@ public override Task<DbCommand> GetExistsTriggerCommandAsync(DbTriggerType trigg
 
         var command = connection.CreateCommand();
         command.Transaction = transaction;
-        command.CommandText = $"SELECT COUNT(*) FROM sqlite_master WHERE type='trigger' AND name='{triggerName}'";
+        command.CommandText = "SELECT COUNT(*) FROM sqlite_master WHERE type='trigger' AND name=@name";
+        var nameParam = command.CreateParameter();
+        nameParam.ParameterName = "@name";
+        nameParam.Value = triggerName;
+        command.Parameters.Add(nameParam);
         return Task.FromResult(command);
     }
 
@@ -277,7 +289,7 @@ public override Task<DbCommand> GetDropTriggerCommandAsync(DbTriggerType trigger
 
         var command = connection.CreateCommand();
         command.Transaction = transaction;
-        command.CommandText = $"DROP TRIGGER IF EXISTS [{triggerName}]";
+        command.CommandText = $"DROP TRIGGER IF EXISTS [{triggerName}]"; // NOSONAR:S2077 - {triggerName} whitelisted via SqlIdentifier.EnsureSafe
         return Task.FromResult(command);
     }
 

src/SharpCoreDB.Server.Core/Tenancy/TenantBackupRestoreService.cs

@@ -314,9 +314,21 @@ private async Task ValidateDatabaseFileAsync(
 
     private static string BuildBackupPath(string backupDirectory, string tenantId, string databaseName)
     {
-        return Path.Combine(
-            backupDirectory,
-            $"tenant-{tenantId}-{databaseName}-{DateTime.UtcNow:yyyyMMddHHmmss}.backup");
+        // tenantId/databaseName were validated by EnsureSafePathSegment (single path segment, no
+        // separators or '..'); Path.GetFileName is applied again as belt-and-braces so no traversal
+        // can survive into the backup file name.
+        var fileName = $"tenant-{Path.GetFileName(tenantId)}-{Path.GetFileName(databaseName)}-{DateTime.UtcNow:yyyyMMddHHmmss}.backup";
+        var fullPath = Path.GetFullPath(Path.Combine(backupDirectory, fileName));
+
+        // Defense in depth: the resolved path must stay inside the configured backup directory.
+        if (!IsPathWithinRoot(backupDirectory, fullPath))
+        {
+            throw new ArgumentException(
+                "The backup path escapes the configured backup directory.",
+                nameof(backupDirectory));
+        }
+
+        return fullPath;
     }
 
     /// <summary>
@@ -348,6 +360,15 @@ private static string EnsureAbsolutePath(string path, string paramName)
         return Path.GetFullPath(path);
     }
 
+    /// <summary>
+    /// Returns true when <paramref name="candidatePath"/> resolves inside <paramref name="rootPath"/>.
+    /// </summary>
+    private static bool IsPathWithinRoot(string rootPath, string candidatePath)
+    {
+        var root = Path.GetFullPath(rootPath).TrimEnd(Path.DirectorySeparatorChar) + Path.DirectorySeparatorChar;
+        return candidatePath.StartsWith(root, StringComparison.OrdinalIgnoreCase);
+    }
+
     private static async Task ReplacePathAsync(string sourcePath, string targetPath, CancellationToken cancellationToken)
     {
         if (PathExists(targetPath))
@@ -363,6 +384,10 @@ private static async Task CopyPathAsync(string sourcePath, string targetPath, Ca
         ArgumentException.ThrowIfNullOrWhiteSpace(sourcePath);
         ArgumentException.ThrowIfNullOrWhiteSpace(targetPath);
 
+        // Normalize to absolute, well-formed paths before any filesystem operation.
+        sourcePath = Path.GetFullPath(sourcePath);
+        targetPath = Path.GetFullPath(targetPath);
+
         if (Directory.Exists(sourcePath))
         {
             Directory.CreateDirectory(targetPath);
@@ -398,6 +423,8 @@ private static async Task CopyPathAsync(string sourcePath, string targetPath, Ca
 
     private static long GetPathSizeBytes(string path)
     {
+        path = Path.GetFullPath(path);
+
         if (File.Exists(path))
         {
             return new FileInfo(path).Length;
@@ -416,6 +443,8 @@ private static long GetPathSizeBytes(string path)
 
     private static void DeletePath(string path)
     {
+        path = Path.GetFullPath(path);
+
         if (File.Exists(path))
         {
             File.Delete(path);
@@ -433,6 +462,10 @@ private static async Task CopyFileAsync(string sourcePath, string targetPath, Ca
         ArgumentException.ThrowIfNullOrWhiteSpace(sourcePath);
         ArgumentException.ThrowIfNullOrWhiteSpace(targetPath);
 
+        // Normalize to absolute, well-formed paths before any filesystem operation.
+        sourcePath = Path.GetFullPath(sourcePath);
+        targetPath = Path.GetFullPath(targetPath);
+
         await using var source = new FileStream(
             sourcePath,
             FileMode.Open,

src/SharpCoreDB/DataStructures/Table.Scanning.cs

@@ -220,36 +220,17 @@ private bool EvaluateWhere(Dictionary<string, object> row, string? where)
         // ✅ Issue #339: support IN / NOT IN lists for all column types.
         // Previously the list was split on spaces (losing everything after the first
         // comma when the SQL contains spaces, e.g. IN ('a', 'b')), and non-string
-        // columns fell through the switch's default → accept-all. Extract the full
-        // parenthesized list via regex and evaluate it as a whole.
-        var inMatch = System.Text.RegularExpressions.Regex.Match(
-            where, @"^(.+?)\s+(NOT\s+)?IN\s*\((.*)\)\s*$",
-            System.Text.RegularExpressions.RegexOptions.IgnoreCase | System.Text.RegularExpressions.RegexOptions.Singleline,
-            TimeSpan.FromSeconds(1));
-        if (inMatch.Success)
+        // columns fell through the switch's default → accept-all. Parsing is shared via
+        // SqlInPredicate so every path evaluates the full parenthesized list.
+        if (SqlInPredicate.TryParseCondition(where, out var inCol, out var inNegated, out var inItems))
         {
-            var inCol = inMatch.Groups[1].Value.Trim();
-            var inDotIdx = inCol.LastIndexOf('.');
-            if (inDotIdx >= 0 && inDotIdx < inCol.Length - 1)
-            {
-                inCol = inCol[(inDotIdx + 1)..];
-            }
-
-            inCol = inCol.Trim('"', '[', ']', '`');
-            var negated = inMatch.Groups[2].Success;
-
             if (!row.TryGetValue(inCol, out var inRowVal) || inRowVal is null or DBNull)
             {
                 return false;
             }
 
-            var inItems = inMatch.Groups[3].Value
-                .Split(',')
-                .Select(v => v.Trim().Trim('\'', '"'))
-                .ToList();
-
-            var matched = inItems.Contains(inRowVal.ToString() ?? string.Empty);
-            return negated ? !matched : matched;
+            var matched = SqlInPredicate.IsMatch(inRowVal, inItems);
+            return inNegated ? !matched : matched;
         }
 
         // ✅ Parity: delegate LIKE / NOT LIKE / BETWEEN (single-condition form) to the shared

src/SharpCoreDB/Services/SqlInPredicate.cs

@@ -0,0 +1,105 @@
+// <copyright file="SqlInPredicate.cs" company="MPCoreDeveloper">
+// Copyright (c) 2025-2026 MPCoreDeveloper and GitHub Copilot. All rights reserved.
+// Licensed under the MIT License. See LICENSE file in the project root for full license information.
+// </copyright>
+
+namespace SharpCoreDB.Services;
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+
+/// <summary>
+/// Shared IN / NOT IN predicate parsing and evaluation, used by every WHERE evaluation path
+/// (single-file <see cref="SingleFileTable"/>, directory-mode <see cref="DataStructures.Table"/>
+/// and the enhanced AST evaluator). Centralizing the logic here prevents the value-list
+/// parsing from drifting between paths (GitHub issue #339).
+/// </summary>
+internal static class SqlInPredicate
+{
+    private static readonly Regex InConditionPattern = new(
+        @"^(.+?)\s+(NOT\s+)?IN\s*\((.*)\)\s*$",
+        RegexOptions.IgnoreCase | RegexOptions.Singleline,
+        TimeSpan.FromSeconds(1));
+
+    /// <summary>
+    /// Parses a single-condition IN / NOT IN clause: <c>col IN ('a', 'b')</c> or
+    /// <c>col NOT IN (1, 2)</c>. Returns the normalized column name (alias-qualified and
+    /// quoted references are stripped), whether the clause is negated, and the trimmed items.
+    /// </summary>
+    /// <param name="condition">The condition text, e.g. <c>node_type IN ('WorkItem', 'Person')</c>.</param>
+    /// <param name="column">The normalized column name.</param>
+    /// <param name="negated">True when the clause is <c>NOT IN</c>.</param>
+    /// <param name="items">The trimmed, quote-stripped list items.</param>
+    /// <returns>True when the condition is a well-formed IN/NOT IN clause.</returns>
+    public static bool TryParseCondition(string condition, out string column, out bool negated, out List<string> items)
+    {
+        column = string.Empty;
+        negated = false;
+        items = [];
+
+        var match = InConditionPattern.Match(condition);
+        if (!match.Success)
+        {
+            return false;
+        }
+
+        column = NormalizeColumn(match.Groups[1].Value);
+        negated = match.Groups[2].Success;
+        items = match.Groups[3].Value
+            .Split(',')
+            .Select(v => v.Trim().Trim('\'', '"'))
+            .ToList();
+
+        return true;
+    }
+
+    /// <summary>
+    /// Evaluates a row value against an already-parsed IN list by comparing <see cref="object.ToString"/>.
+    /// </summary>
+    /// <param name="rowValue">The row value to test.</param>
+    /// <param name="items">The parsed list items.</param>
+    /// <returns>True when the row value is contained in the list.</returns>
+    public static bool IsMatch(object? rowValue, IEnumerable<string> items)
+        => items.Contains(rowValue?.ToString() ?? string.Empty);
+
+    /// <summary>
+    /// Evaluates a raw IN value list (e.g. <c>('a', 'b')</c> or <c>(1,2,3)</c>) against a row value.
+    /// Strips surrounding parentheses (when present), splits on commas and trims quotes.
+    /// </summary>
+    /// <param name="rowValue">The row value to test.</param>
+    /// <param name="listValue">The raw value list text.</param>
+    /// <returns>True when the row value is contained in the list.</returns>
+    public static bool ValueInList(string? rowValue, string? listValue)
+    {
+        if (listValue is null)
+        {
+            return false;
+        }
+
+        var trimmed = listValue.Trim();
+        if (trimmed.StartsWith('(') && trimmed.EndsWith(')'))
+        {
+            trimmed = trimmed[1..^1];
+        }
+
+        return trimmed.Split(',').Select(v => v.Trim().Trim('\'', '"')).Contains(rowValue);
+    }
+
+    /// <summary>
+    /// Normalizes a column reference to the bare row-key form: strips alias qualifiers
+    /// (e.g. <c>b.Url</c> to <c>Url</c>) and identifier quotes (<c>"</c>, <c>[</c>, <c>]</c>, <c>`</c>).
+    /// </summary>
+    private static string NormalizeColumn(string columnName)
+    {
+        var trimmed = columnName.Trim();
+        var dotIndex = trimmed.LastIndexOf('.');
+        if (dotIndex >= 0 && dotIndex < trimmed.Length - 1)
+        {
+            trimmed = trimmed[(dotIndex + 1)..];
+        }
+
+        return trimmed.Trim('"', '[', ']', '`');
+    }
+}

src/SharpCoreDB/Services/SqlParser.Helpers.cs

@@ -581,8 +581,8 @@ int Compare(object? a, object? b)
             "NOT LIKE" => rowValueStr is not null && value is not null && !LikeMatch(rowValueStr, value),
             "REGEXP" => rowValueStr is not null && value is not null && Regex.IsMatch(rowValueStr, value, RegexOptions.None, TimeSpan.FromSeconds(1)),
             "NOT REGEXP" => rowValueStr is null || value is null || !Regex.IsMatch(rowValueStr, value, RegexOptions.None, TimeSpan.FromSeconds(1)),
-            "IN" => EvaluateInList(rowValueStr, value),
-            "NOT IN" => !EvaluateInList(rowValueStr, value),
+            "IN" => SqlInPredicate.ValueInList(rowValueStr, value),
+            "NOT IN" => !SqlInPredicate.ValueInList(rowValueStr, value),
             _ => throw new InvalidOperationException($"Unsupported operator {op}"),
         };
     }
@@ -641,26 +641,6 @@ private static bool LikeMatch(string input, string pattern)
         return Regex.IsMatch(input, regex, RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1));
     }
 
-    /// <summary>
-    /// Evaluates an IN value list: "('a', 'b')" or "(1,2,3)".
-    /// Strips surrounding parentheses (if present), splits on commas and trims quotes.
-    /// </summary>
-    private static bool EvaluateInList(string? rowValue, string? listValue)
-    {
-        if (listValue is null)
-        {
-            return false;
-        }
-
-        var trimmed = listValue.Trim();
-        if (trimmed.StartsWith('(') && trimmed.EndsWith(')'))
-        {
-            trimmed = trimmed[1..^1];
-        }
-
-        return trimmed.Split(',').Select(v => v.Trim().Trim('\'', '"')).Contains(rowValue);
-    }
-
     /// <summary>
     /// Binds parameters to a SQL query string, replacing placeholders with actual values.
     /// Supports both named parameters (@paramName) and positional parameters (?).

src/SharpCoreDB/SingleFileTable.cs

@@ -1162,26 +1162,15 @@ private static bool EvaluateSingleCondition(Dictionary<string, object> row, stri
 
         // ✅ Issue #339: support IN / NOT IN lists (previously not in the operator list,
         // so the condition fell through to "accept all rows").
-        var inMatch = System.Text.RegularExpressions.Regex.Match(
-            trimmed, @"^(.+?)\s+(NOT\s+)?IN\s*\((.*)\)\s*$",
-            System.Text.RegularExpressions.RegexOptions.IgnoreCase | System.Text.RegularExpressions.RegexOptions.Singleline,
-            TimeSpan.FromSeconds(1));
-        if (inMatch.Success)
-        {
-            var inCol = NormalizeColumnName(inMatch.Groups[1].Value);
-            var negated = inMatch.Groups[2].Success;
+        if (SqlInPredicate.TryParseCondition(trimmed, out var inCol, out var inNegated, out var inItems))
+        {
             if (!row.TryGetValue(inCol, out var inRowVal) || inRowVal is null or DBNull)
             {
                 return false;
             }
 
-            var inItems = inMatch.Groups[3].Value
-                .Split(',')
-                .Select(v => v.Trim().Trim('\'', '"'))
-                .ToList();
-
-            var matched = inItems.Contains(inRowVal.ToString() ?? string.Empty);
-            return negated ? !matched : matched;
+            var matched = SqlInPredicate.IsMatch(inRowVal, inItems);
+            return inNegated ? !matched : matched;
         }
 
         var operators = new[] { ">=", "<=", "!=", "<>", "=", ">", "<" };