fix: dynamic sql generation (#514)

### Feature or Bugfix
- Bugfix

### Detail
- fix how dynamic SQL with varying table names is generated

### Relates
- <URL or Ticket>

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

backend/dataall/api/Objects/DatasetTable/resolvers.py

@@ -12,7 +12,7 @@
 from ....db import permissions, models
 from ....db.api import ResourcePolicy, Glossary
 from ....searchproxy import indexers
-from ....utils import json_utils
+from ....utils import json_utils, sql_utils
 
 log = logging.getLogger(__name__)
 
@@ -141,7 +141,9 @@ def preview(context, source, tableUri: str = None):
         )
         cursor = connection.cursor()
 
-        SQL = f'select * from "{table.GlueDatabaseName}"."{table.GlueTableName}" limit 50'  # nosec
+        SQL = 'select * from {table_identifier} limit 50'.format(
+            table_identifier=sql_utils.Identifier(table.GlueDatabaseName, table.GlueTableName)
+        )
         cursor.execute(SQL)
         fields = []
         for f in cursor.description:

backend/dataall/utils/sql_utils.py

@@ -0,0 +1,22 @@
+import re
+
+
+class Identifier:
+    def __init__(self, *identifiers) -> None:
+        if not identifiers:
+            raise TypeError("Identifier cannot be empty")
+
+        for id in identifiers:
+            if not isinstance(id, str):
+                raise TypeError("SQL identifier parts must be strings")
+            if re.search(r"\W", id):
+                raise TypeError(f"SQL identifier contains invalid characters: {id}")
+
+        self._identifiers = identifiers
+
+    @property
+    def identifiers(self) -> str:
+        return self._identifiers
+
+    def __repr__(self) -> str:
+        return ".".join(self._identifiers)