Quote procname and user variables with backticks in callproc (#789)

`callproc` passed the procedure name and user variable names unquoted
into SQL, making it unsafe for names containing reserved words or
special characters.

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Inada Naoki <songofacandy@gmail.com>

Author: Copilot

src/MySQLdb/cursors.py

@@ -23,6 +23,10 @@
 )
 
 
+def _backquote_escape(s):
+    return s.replace(b"`", b"``")
+
+
 class BaseCursor:
     """A base for Cursor classes. Useful attributes:
 
@@ -279,10 +283,10 @@ def callproc(self, procname, args=()):
         variable and then retrieved by a query. Since stored
         procedures return zero or more result sets, there is no
         reliable way to get at OUT or INOUT parameters via callproc.
-        The server variables are named @_procname_n, where procname
+        The server variables are named @`_procname_n`, where procname
         is the parameter above and n is the position of the parameter
         (from zero). Once all result sets generated by the procedure
-        have been fetched, you can issue a SELECT @_procname_0, ...
+        have been fetched, you can issue a SELECT @`_procname_0`, ...
         query using .execute() to get any OUT or INOUT values.
 
         Compatibility warning: The act of calling a stored procedure
@@ -295,17 +299,18 @@ def callproc(self, procname, args=()):
         db = self._get_db()
         if isinstance(procname, str):
             procname = procname.encode(db.encoding)
+        procname_escaped = _backquote_escape(procname)
         if args:
-            fmt = b"@_" + procname + b"_%d=%s"
+            fmt = b"@`_" + procname_escaped + b"_%d`=%s"
             q = b"SET %s" % b",".join(
                 fmt % (index, db.literal(arg)) for index, arg in enumerate(args)
             )
             self._query(q)
             self.nextset()
 
-        q = b"CALL %s(%s)" % (
-            procname,
-            b",".join([b"@_%s_%d" % (procname, i) for i in range(len(args))]),
+        q = b"CALL `%s`(%s)" % (
+            procname_escaped,
+            b",".join([b"@`_%s_%d`" % (procname_escaped, i) for i in range(len(args))]),
         )
         self._query(q)
         return args

tests/test_cursor.py

@@ -2,6 +2,7 @@
 import MySQLdb.cursors
 from MySQLdb.constants import ER
 from configdb import connection_factory
+from textwrap import dedent
 
 
 _conns = []
@@ -308,3 +309,24 @@ def test_cursor_is_iterator(Cursor):
     assert next(cursor) == ("c",)
     with pytest.raises(StopIteration):
         next(cursor)
+
+
+def test_callproc_escaping():
+    conn = connect()
+    cur = conn.cursor()
+
+    cur.execute("DROP PROCEDURE IF EXISTS `foo.bar`")
+    try:
+        cur.execute(
+            dedent("""\
+            create procedure `foo.bar` (arg1 int)
+            begin
+                select arg1*2;
+            end
+        """)
+        )
+
+        cur.callproc("foo.bar", args=(123,))
+        assert cur.fetchone()[0] == 246
+    finally:
+        cur.execute("DROP PROCEDURE IF EXISTS `foo.bar`")