Repository navigation
guard: jsqlparser 5.4.15, jsqltranspiler 1.13, single parse, second read-only net - #63
Merged
stbischof merged 1 commit intoSep 22, 2026
Conversation
…ead-only net Upgrade the parser and the transpiler to their current releases and close the gaps that come with them. - jsqlparser 5.3.167 -> 5.4.15 (the release jsqltranspiler 1.13 is built against), jsqltranspiler 1.8 -> 1.13: correlated sub queries resolve against the enclosing query, ORDER BY columns are recorded, UNION is handled by the column resolver, OSGi imports for duckdb/h2/json are optional. - ReadOnlyStatementValidator also rejects the MySQL SELECT .. INTO OUTFILE/DUMPFILE/@var clause, which jsqlparser 5.4 now parses, and every ForMode incl. FOR NO KEY UPDATE / FOR KEY SHARE / SKIP LOCKED. - TranspilerSqlGuard parses the input as a script and rejects more than one statement: CCJSqlParserUtil.parse() silently drops a trailing "; DROP TABLE .." (JSQLParser#2681). A comment-only input is empty. - Second net after the own validator: jsqlparser's Statement.getFeatures(pureFunctions) must not report MODIFIES_DATA, MODIFIES_SCHEMA, MODIFIES_SESSION, MODIFIES_TRANSACTION or OPAQUE, and must report a result set. The function whitelist is the purity predicate. - One parse per statement: the validated AST is handed to DeparserColumResolver.getResolvedStatementText(Statement). JSQLResolver expands "*" with the FROM item's full qualification while JSQLColumResolver uses the bare name, so the deparser now normalises column qualifiers to table name or alias; the FROM item carries the schema. - Tests: INTO OUTFILE/DUMPFILE/@var/TEMP, row lock variants, trailing statements, comment-only input, correlated sub queries, window function, qualified column references (300 tests). Signed-off-by: Stefan Bischof <stbischof@bipolis.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The guard ran on jsqlparser 5.3.167 and jsqltranspiler 1.8. Both are behind their current releases, and the newer parser brings syntax the guard has to know about.
What
TableNotDeclared), ORDER BY columns are recorded, UNION is handled by the column resolver and the OSGi imports for duckdb/h2/json are optional.ReadOnlyStatementValidator: also rejects the MySQLSELECT .. INTO OUTFILE/DUMPFILE/@varclause, which jsqlparser 5.4 now parses, and everyForMode(FOR NO KEY UPDATE,FOR KEY SHARE,SKIP LOCKED, ...).parseStatementsand rejects more than one statement.CCJSqlParserUtil.parse()silently drops a trailing; DROP TABLE ..(CCJSqlParserUtil.parse() silently ignores everything after the first statement's semicolon JSQLParser/JSqlParser#2681). A comment-only input is reported as empty.Statement.getFeatures(pureFunctions)must not reportMODIFIES_DATA,MODIFIES_SCHEMA,MODIFIES_SESSION,MODIFIES_TRANSACTIONorOPAQUE, and must report a result set. The function whitelist is the purity predicate. Note: upstream classifiesINTO OUTFILE/DUMPFILEas a plain read, so the own check stays primary.DeparserColumResolver.getResolvedStatementText(Statement).JSQLResolverexpands*with the FROM item's full qualification whileJSQLColumResolveruses the bare name, so the deparser normalises column qualifiers to table name or alias; the FROM item carries the schema. The matching upstream entry points are proposed in feat: Statement entry points for parse and resolved text starlake-ai/jsqltranspiler#153.Tests
SqlGuardTest:INTO OUTFILE/DUMPFILE/@var/TEMP, row lock variants, trailing statements, comment-only input, correlated sub queries, window function, qualified column references. 300 tests, full build green.