fix(contrib/drivers/oracle): fix GBK decode and quoted identifiers

contrib/drivers/oracle/go.mod

@@ -4,7 +4,7 @@ go 1.23.0
 
 require (
 	github.com/gogf/gf/v2 v2.10.2
-	github.com/sijms/go-ora/v2 v2.7.10
+	github.com/sijms/go-ora/v2 v2.7.18
 )
 
 require (

contrib/drivers/oracle/go.sum

@@ -48,8 +48,8 @@ github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/sijms/go-ora/v2 v2.7.10 h1:GSLdj0PYYgSndhsnm7b6p32OqgnwnUZSkFb3j+htfhI=
-github.com/sijms/go-ora/v2 v2.7.10/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
+github.com/sijms/go-ora/v2 v2.7.18 h1:xl9CUeBlFi261AOKekiiFnfcp3ojHFEedLxIzsj909E=
+github.com/sijms/go-ora/v2 v2.7.18/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=

contrib/drivers/oracle/internal/goora/string_converter_test.go

@@ -0,0 +1,24 @@
+// This file verifies go-ora string converter regressions that affect the Oracle driver.
+
+package goora_test
+
+import (
+	"testing"
+
+	"github.com/sijms/go-ora/v2/converters"
+
+	"github.com/gogf/gf/v2/test/gtest"
+)
+
+// goOraCharsetGBK is the Oracle charset ID for the go-ora GBK converter.
+const goOraCharsetGBK = 0x354
+
+// TestStringConverterDecodeGBKTrailingLeadByte verifies a truncated GBK sequence does not panic.
+func TestStringConverterDecodeGBKTrailingLeadByte(t *testing.T) {
+	gtest.C(t, func(t *gtest.T) {
+		converter := converters.NewStringConverter(goOraCharsetGBK)
+		decoded := converter.Decode([]byte{0x81})
+
+		t.Assert(decoded, string([]byte{0x81}))
+	})
+}

contrib/drivers/oracle/oracle.go

@@ -18,7 +18,7 @@ type Driver struct {
 
 const (
 	rowNumberAliasForSelect = `ROW_NUMBER__`
-	quoteChar               = `"`
+	quoteChar               = ``
 )
 
 func init() {
@@ -41,6 +41,7 @@ func (d *Driver) New(core *gdb.Core, node *gdb.ConfigNode) (gdb.DB, error) {
 }
 
 // GetChars returns the security char for this type of database.
+// Oracle generated SQL uses unquoted identifiers, while raw SQL keeps explicit quotes.
 func (d *Driver) GetChars() (charLeft string, charRight string) {
 	return quoteChar, quoteChar
 }

contrib/drivers/oracle/oracle_do_filter.go

@@ -45,10 +45,6 @@ func (d *Driver) DoFilter(ctx context.Context, link gdb.Link, sql string, args [
 	if err != nil {
 		return
 	}
-	newSql, err = gregex.ReplaceString("\"", "", newSql)
-	if err != nil {
-		return
-	}
 	newSql, err = d.parseSql(newSql)
 	if err != nil {
 		return

contrib/drivers/oracle/oracle_do_filter_test.go

@@ -0,0 +1,47 @@
+// Copyright GoFrame Author(https://goframe.org). All Rights Reserved.
+//
+// This Source Code Form is subject to the terms of the MIT License.
+// If a copy of the MIT was not distributed with this file,
+// You can obtain one at https://github.com/gogf/gf.
+
+// This file verifies Oracle SQL filtering behavior that does not require a database connection.
+
+package oracle
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/gogf/gf/v2/test/gtest"
+)
+
+// TestDriverDoFilterPreservesQuotedIdentifiers verifies explicit Oracle quoted identifiers survive filtering.
+func TestDriverDoFilterPreservesQuotedIdentifiers(t *testing.T) {
+	gtest.C(t, func(t *gtest.T) {
+		var (
+			driver = &Driver{}
+			args   = []any{1}
+			sql    = `SELECT "userName" FROM "mixedCaseTable" WHERE "id" = ? LIMIT 1`
+		)
+
+		newSql, newArgs, err := driver.DoFilter(context.Background(), nil, sql, args)
+
+		t.AssertNil(err)
+		t.Assert(newArgs, args)
+		t.Assert(strings.Contains(newSql, `"userName"`), true)
+		t.Assert(strings.Contains(newSql, `"mixedCaseTable"`), true)
+		t.Assert(strings.Contains(newSql, `"id" = :v1`), true)
+		t.Assert(strings.Contains(newSql, `ROWNUM <= 1`), true)
+	})
+}
+
+// TestDriverGetCharsDoesNotAddImplicitQuotes verifies generated SQL leaves Oracle identifiers unquoted by default.
+func TestDriverGetCharsDoesNotAddImplicitQuotes(t *testing.T) {
+	gtest.C(t, func(t *gtest.T) {
+		charLeft, charRight := (&Driver{}).GetChars()
+
+		t.Assert(charLeft, "")
+		t.Assert(charRight, "")
+	})
+}

openspec/changes/fix-go-ora-string-converter-panic/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-06

openspec/changes/fix-go-ora-string-converter-panic/proposal.md

@@ -0,0 +1,23 @@
+## Why
+
+The Oracle driver currently depends on `github.com/sijms/go-ora/v2 v2.7.10`, whose GBK string converter can panic while decoding malformed or truncated multibyte data. A previously applied manual source edit targeted the vendored `StringConverter.Decode` implementation, but this repository does not commit that vendor path, so the fix would not reliably reach the mainline module build.
+
+## What Changes
+
+- Upgrade the Oracle driver's go-ora dependency to the smallest upstream version that includes the `StringConverter.Decode` bounds check fix.
+- Add a focused regression test that exercises the GBK converter with a trailing lead byte and verifies decoding does not panic.
+- Document the root cause so future maintainers do not reintroduce a manual vendor-source workaround.
+
+## Capabilities
+
+### New Capabilities
+- `oracle-driver-dependencies`: Keeps the Oracle driver on a go-ora version that handles truncated GBK decode input without panicking.
+
+### Modified Capabilities
+- None.
+
+## Impact
+
+- `contrib/drivers/oracle/go.mod`
+- `contrib/drivers/oracle/go.sum`
+- Oracle driver dependency verification tests

openspec/changes/fix-go-ora-string-converter-panic/specs/oracle-driver-dependencies/spec.md

@@ -0,0 +1,8 @@
+## ADDED Requirements
+
+### Requirement: Oracle driver dependency safety
+The Oracle driver SHALL depend on a go-ora version whose string converter safely handles truncated multibyte input without panicking.
+
+#### Scenario: GBK decode receives a trailing lead byte
+- **WHEN** the go-ora GBK string converter decodes input whose last byte is greater than `0x80` and no following byte is available
+- **THEN** decoding SHALL return without panicking

openspec/changes/fix-go-ora-string-converter-panic/tasks.md

@@ -0,0 +1,4 @@
+## Feedback
+
+- [x] **FB-1**: go-ora GBK string converter panics on trailing one-byte input
+- [x] **FB-2**: Oracle SQL filter strips quoted identifier case information