Validate in-memory db names, move SQLite-specific methods to the SQLiteManager

src/Database/TenantDatabaseManagers/SQLiteDatabaseManager.php

@@ -11,6 +11,7 @@ use Stancl\Tenancy\Database\Concerns\ValidatesDatabaseParameters;
 use Stancl\Tenancy\Database\Contracts\TenantDatabaseManager;
 use Stancl\Tenancy\Database\Contracts\TenantWithDatabase;
 use Throwable;
+use InvalidArgumentException;
 
 class SQLiteDatabaseManager implements TenantDatabaseManager
 {
@@ -60,6 +61,16 @@ class SQLiteDatabaseManager implements TenantDatabaseManager
      */
     public static Closure|null $closeInMemoryConnectionUsing = null;
 
+    /**
+     * Characters allowed in database names.
+     *
+     * Includes dots to support file extensions (e.g. '.sqlite').
+     */
+    protected static function allowedDatabaseNameCharacters(): string
+    {
+        return 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-.';
+    }
+
     public function createDatabase(TenantWithDatabase $tenant): bool
     {
         /** @var TenantWithDatabase&Model $tenant */
@@ -136,6 +147,8 @@ class SQLiteDatabaseManager implements TenantDatabaseManager
                 (static::$persistInMemoryConnectionUsing)(new PDO($dsn), $dsn);
             }
         } else {
+            $this->validateDatabaseName($databaseName);
+
             $baseConfig['database'] = database_path($databaseName);
         }
 
@@ -148,13 +161,44 @@ class SQLiteDatabaseManager implements TenantDatabaseManager
             return rtrim(static::$path, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . $name;
         }
 
-        $this->validateFilename($name);
+        $this->validateDatabaseName($name);
 
         return database_path($name);
     }
 
     public static function isInMemory(string $name): bool
     {
-        return $name === ':memory:' || str_starts_with($name, 'file:_tenancy_inmemory_');
+        if ($name === ':memory:') {
+            return true;
+        }
+
+        if (str_starts_with($name, 'file:_tenancy_inmemory_') &&
+            str_ends_with($name, '?mode=memory&cache=shared')) {
+            // Named in-memory DBs are formatted like 'file:_tenancy_inmemory_tenant123?mode=memory&cache=shared'
+            static::validateDatabaseName($name, ':?=&');
+
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * Ensure database name only contains allowed characters
+     * (static::allowedDatabaseNameCharacters() + $extraAllowedCharacters) and is not a directory name.
+     *
+     * @throws InvalidArgumentException
+     */
+    protected static function validateDatabaseName(string $name, string $extraAllowedCharacters = ''): void
+    {
+        static::validateParameter($name, static::allowedDatabaseNameCharacters() . $extraAllowedCharacters);
+
+        if ($name === '') {
+            throw new InvalidArgumentException('Database name cannot be empty.');
+        }
+
+        if (is_dir($name)) {
+            throw new InvalidArgumentException("Database name cannot be a directory.");
+        }
     }
 }