Repository navigation
Fix/fallback backtick identifiers - #103
Merged
Merged
Conversation
A table or column named like a keyword (`where`, `limit`) was read as a clause by the fallback parser. IsMultiStatement keeps its own reading, since a backtick is no quote in PostgreSQL. Fixes #99
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
codeant-ai
Bot
added
the
size:M
Blank a backtick run to `x` rather than nothing so YEAR(`d`) still reads as a function on a column, and leave an unterminated backtick alone.
CodeAnt Nitpicks1 custom suggestion1. Replace
|
CodeAnt PR Risk: Low Risk
Assessed commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The default parser blanked string literals but not backtick-quoted identifiers, so a table or column named like a keyword was read as a clause:
DELETE FROM `where`counted aWHERE, and a MySQL column namedlimitcounted aLIMIT. That hiddelete-without-where,update-without-whereandselect-without-limitfindings on MySQL/MariaDB queries.Backtick runs are now reduced to
`x`before the clause scan.xrather than nothing keeps a quoted column visible to the function-on-column check, soWHERE YEAR(`d`) = 1still reportsnon-sargable-predicate. An unterminated backtick is left alone instead of swallowing the rest of the statement.IsMultiStatementdeliberately keeps its own reading (it does not blank backticks): a backtick is no quote in PostgreSQL, and a run of them must not hide a;.Closes #99
Type of change
Checklist
make cipasses (fmt-check, vet, lint, vuln, test-race, lint-docs) across all moduleswebsite/docs/with a version marker for anything new (n/a: no public API or documented behaviour change)AGENTS.md/.sqlguard.example.ymlif a convention or config key changed (n/a: no convention changed)## [Unreleased]inCHANGELOG.mdanalyzer/middleware/reporterResult)Notes for reviewers
TestFallbackParserBacktickIdentifierscovers keyword-named tables and columns, doubled and unterminated backticks, and a backtick inside a string;TestFallbackParserBacktickNonSargablecovers a function over a quoted column. The identifier cases fail without the fix.mainand not changed here:stripCommentsis not backtick-aware, so a--inside a backtick name (FROM `a--b`) still starts a comment. Copying backtick runs verbatim there would also reachRedact, where a stray backtick could leave a comment's contents in the output, so it needs its own change.