Repository navigation
fix: ignore quoted SQL when binding native parameters #348
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,168 @@ | ||
| <?php | ||
|
|
||
| declare(strict_types=1); | ||
|
|
||
| namespace SimPod\ClickHouseClient\Sql; | ||
|
|
||
| use RuntimeException; | ||
|
|
||
| use function preg_last_error_msg; | ||
| use function preg_match; | ||
| use function strlen; | ||
| use function strpos; | ||
| use function strspn; | ||
| use function substr; | ||
|
|
||
| /** @internal */ | ||
| final class NativeParameterParser | ||
| { | ||
| private const string WordCharacters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_'; | ||
|
|
||
| /** @return array<string, Type> */ | ||
| public static function parse(string $sql): array | ||
| { | ||
| $types = []; | ||
| $length = strlen($sql); | ||
| $offset = 0; | ||
| $heredocPositions = null; | ||
| $heredocCursors = []; | ||
| while ($offset < $length) { | ||
| $char = $sql[$offset]; | ||
| if ($char === "'" || $char === '"' || $char === '`') { | ||
| $offset = self::skipQuoted($sql, $offset, $char); | ||
|
|
||
| continue; | ||
| } | ||
|
|
||
| if ($char === "\xE2") { | ||
| $quote = substr($sql, $offset, 3); | ||
| if ($quote === '‘' || $quote === '“') { | ||
| $end = strpos($sql, $quote === '‘' ? '’' : '”', $offset + 3); | ||
| $offset = $end === false ? $length : $end + 3; | ||
|
|
||
| continue; | ||
| } | ||
| } | ||
|
|
||
| $prefix = substr($sql, $offset, 2); | ||
| if ($prefix === '--' || $prefix === '//' || $prefix === '# ' || $prefix === '#!') { | ||
| $end = strpos($sql, "\n", $offset + 2); | ||
| $offset = $end === false ? $length : $end + 1; | ||
|
|
||
| continue; | ||
| } | ||
|
|
||
| if ($prefix === '/*') { | ||
| $offset = self::skipComment($sql, $offset); | ||
|
|
||
| continue; | ||
| } | ||
|
|
||
| if ($char === '$') { | ||
| $tagEnd = $offset + 1 + strspn($sql, self::WordCharacters, $offset + 1); | ||
| if ($tagEnd < $length && $sql[$tagEnd] === '$') { | ||
| $delimiter = substr($sql, $offset, $tagEnd - $offset + 1); | ||
| $heredocPositions ??= self::indexHeredocDelimiters($sql); | ||
| $positions = $heredocPositions[$delimiter]; | ||
| $cursor = $heredocCursors[$delimiter] ?? 0; | ||
| while (isset($positions[$cursor]) && $positions[$cursor] <= $tagEnd) { | ||
| ++$cursor; | ||
| } | ||
|
|
||
| $heredocCursors[$delimiter] = $cursor; | ||
| if (isset($positions[$cursor])) { | ||
| $offset = $positions[$cursor] + strlen($delimiter); | ||
|
|
||
| continue; | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if ($char === '{') { | ||
| $matched = preg_match( | ||
| '~\G\{([a-zA-Z\d_]+)\s*:\s*([a-zA-Z\d ]+(?:\([^{}]*\))*)\s*}~', | ||
| $sql, | ||
| $matches, | ||
| offset: $offset, | ||
| ); | ||
| if ($matched === false) { | ||
| throw new RuntimeException('Failed to parse native query parameter: ' . preg_last_error_msg()); | ||
| } | ||
|
|
||
| if ($matched === 1) { | ||
| $types[$matches[1]] = Type::fromString($matches[2]); | ||
| $offset += strlen($matches[0]); | ||
|
|
||
| continue; | ||
| } | ||
| } | ||
|
|
||
| // Dollar signs can belong to bare identifiers; do not start a heredoc halfway through one. | ||
| $wordLength = strspn($sql, self::WordCharacters . '$', $offset); | ||
| $offset += $wordLength > 0 ? $wordLength : 1; | ||
| } | ||
|
|
||
| return $types; | ||
| } | ||
|
|
||
| /** @return array<string, list<int>> */ | ||
| private static function indexHeredocDelimiters(string $sql): array | ||
| { | ||
| // Index overlapping delimiters once so distinct dollar-bearing identifiers do not rescan the whole SQL. | ||
| $positions = []; | ||
| $length = strlen($sql); | ||
| $offset = strpos($sql, '$'); | ||
| while ($offset !== false) { | ||
| $tagEnd = $offset + 1 + strspn($sql, self::WordCharacters, $offset + 1); | ||
| if ($tagEnd < $length && $sql[$tagEnd] === '$') { | ||
| $delimiter = substr($sql, $offset, $tagEnd - $offset + 1); | ||
| $positions[$delimiter][] = $offset; | ||
| } | ||
|
|
||
| $offset = strpos($sql, '$', $offset + 1); | ||
| } | ||
|
|
||
| return $positions; | ||
| } | ||
|
|
||
| private static function skipQuoted(string $sql, int $offset, string $quote): int | ||
| { | ||
| $length = strlen($sql); | ||
| ++$offset; | ||
| while ($offset < $length) { | ||
| $char = $sql[$offset++]; | ||
| if ($char === '\\') { | ||
| ++$offset; | ||
| } elseif ($char === $quote) { | ||
| if ($offset >= $length || $sql[$offset] !== $quote) { | ||
| break; | ||
| } | ||
|
|
||
| ++$offset; | ||
| } | ||
| } | ||
|
|
||
| return $offset; | ||
| } | ||
|
|
||
| private static function skipComment(string $sql, int $offset): int | ||
| { | ||
| $length = strlen($sql); | ||
| $offset += 2; | ||
| $depth = 1; | ||
| while ($offset < $length && $depth > 0) { | ||
| $prefix = substr($sql, $offset, 2); | ||
| if ($prefix === '/*') { | ||
| ++$depth; | ||
| $offset += 2; | ||
| } elseif ($prefix === '*/') { | ||
| --$depth; | ||
| $offset += 2; | ||
| } else { | ||
| ++$offset; | ||
| } | ||
| } | ||
|
|
||
| return $offset; | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| <?php | ||
|
|
||
| declare(strict_types=1); | ||
|
|
||
| namespace SimPod\ClickHouseClient\Tests\Sql; | ||
|
|
||
| use Generator; | ||
| use PHPUnit\Framework\Attributes\CoversClass; | ||
| use PHPUnit\Framework\Attributes\DataProvider; | ||
| use SimPod\ClickHouseClient\Sql\NativeParameterParser; | ||
| use SimPod\ClickHouseClient\Sql\Type; | ||
| use SimPod\ClickHouseClient\Tests\TestCaseBase; | ||
|
|
||
| use function array_map; | ||
| use function implode; | ||
| use function range; | ||
| use function str_repeat; | ||
|
|
||
| #[CoversClass(NativeParameterParser::class)] | ||
| final class NativeParameterParserTest extends TestCaseBase | ||
| { | ||
| public function testParse(): void | ||
| { | ||
| self::assertEquals( | ||
| [ | ||
| 'serverIds' => Type::fromString('Array(UUID)'), | ||
| 'sensorIds' => Type::fromString('Array(Array(UUID))'), | ||
| 'recordedAt' => Type::fromString("DateTime64(6, 'UTC')"), | ||
| ], | ||
| NativeParameterParser::parse( | ||
| "SELECT {serverIds: Array(UUID)}, {sensorIds:Array(Array(UUID))}, {recordedAt:DateTime64(6, 'UTC')}", | ||
| ), | ||
| ); | ||
| } | ||
|
|
||
| #[DataProvider('provideParseIgnoredText')] | ||
| public function testParseIgnoredText(string $sql): void | ||
| { | ||
| self::assertSame([], NativeParameterParser::parse($sql)); | ||
| } | ||
|
|
||
| /** @phpstan-return Generator<string, array{string}> */ | ||
| public static function provideParseIgnoredText(): Generator | ||
| { | ||
| yield 'string literal' => ["SELECT '{context:UnknownType}'"]; | ||
| yield 'escaped quote' => [ | ||
| <<<'SQL' | ||
| SELECT 'it\'s {context:UnknownType}' | ||
| SQL, | ||
| ]; | ||
|
|
||
| yield 'doubled quote' => ["SELECT 'it''s {context:UnknownType}'"]; | ||
| yield 'double-quoted identifier' => ['SELECT "{context:UnknownType}"']; | ||
| yield 'doubled double quote' => ['SELECT "a""{context:UnknownType}"']; | ||
| yield 'backtick-quoted identifier' => ['SELECT `{context:UnknownType}`']; | ||
| yield 'escaped backtick' => ['SELECT `a\`{context:UnknownType}`']; | ||
| yield 'unicode string literal' => ['SELECT ‘{context:UnknownType}’']; | ||
| yield 'unicode string with em dash' => ['SELECT ‘a—{context:UnknownType}’']; | ||
| yield 'unicode quoted identifier' => ['SELECT “{context:UnknownType}”']; | ||
| yield 'unicode identifier with emoji' => ['SELECT “😀{context:UnknownType}”']; | ||
| yield 'heredoc' => ['SELECT $$\'quoted\' {context:UnknownType} $$']; | ||
| yield 'tagged heredoc' => ['SELECT $sql$\'quoted\' {context:UnknownType} $other$ $sql$']; | ||
| yield 'dash comment' => ["SELECT 1 -- 'quoted' {context:UnknownType}\n"]; | ||
| yield 'comment at end of input' => ['SELECT 1 -- {context:UnknownType}']; | ||
| yield 'slash comment' => ["SELECT 1 // 'quoted' {context:UnknownType}\n"]; | ||
| yield 'hash comment' => ["SELECT 1 # 'quoted' {context:UnknownType}\n"]; | ||
| yield 'shebang comment' => ["#! {context:UnknownType}\nSELECT 1"]; | ||
| yield 'block comment' => ["SELECT 1 /* 'quoted' {context:UnknownType} */"]; | ||
| yield 'block comment starting with slash' => ['SELECT 1 /*/ {context:UnknownType} */']; | ||
| yield 'nested block comment' => ['SELECT 1 /* /* nested */ {context:UnknownType} */']; | ||
| yield 'nested comment starting with slash' => ['SELECT 1 /* /*/ nested */ {context:UnknownType} */']; | ||
| } | ||
|
|
||
| #[DataProvider('provideParseAroundIgnoredText')] | ||
| public function testParseAroundIgnoredText(string $sql): void | ||
| { | ||
| self::assertEquals(['context' => Type::fromString('String')], NativeParameterParser::parse($sql)); | ||
| } | ||
|
|
||
| /** @phpstan-return Generator<string, array{string}> */ | ||
| public static function provideParseAroundIgnoredText(): Generator | ||
| { | ||
| yield 'literal before real parameter' => ["SELECT '{context:UnknownType}', {context:String}"]; | ||
| yield 'literal after real parameter' => ["SELECT {context:String}, '{context:UnknownType}'"]; | ||
| yield 'parameter after escaped backslash' => [ | ||
| <<<'SQL' | ||
| SELECT '\\', {context:String} | ||
| SQL, | ||
| ]; | ||
|
|
||
| yield 'parameter after line comment' => ["SELECT -- {context:UnknownType}\n{context:String}"]; | ||
| yield 'parameter after empty line comment' => ["SELECT --\n{context:String}"]; | ||
| yield 'parameter after empty block comment' => ['SELECT /**/{context:String}']; | ||
| yield 'parameter directly after block comment' => ['SELECT /* ignored */{context:String}']; | ||
| yield 'division directly after block comment' => ['SELECT 8 /* ignored *// {context:String}']; | ||
| yield 'adjacent nested comment delimiters' => ['SELECT /* /**/*/ {context:String}']; | ||
| yield 'parameter after nested comment' => ['SELECT /* /* nested */ {context:UnknownType} */ {context:String}']; | ||
|
|
||
| yield 'parameter after heredoc' => ['SELECT $sql${context:UnknownType}$sql$, {context:String}']; | ||
| yield 'heredoc after real parameter' => ['SELECT {context:String}, $sql${context:UnknownType}$sql$']; | ||
| yield 'parameter after empty heredoc' => ['SELECT $$$$, {context:String}']; | ||
| yield 'parameter after unicode identifier' => ['SELECT “😀{context:UnknownType}”, {context:String}']; | ||
| yield 'parameter after empty unicode string' => ['SELECT ‘’, {context:String}']; | ||
| yield 'unicode mathematical minus' => ['SELECT 1 − 2, {context:String}']; | ||
| yield 'dollars in bare identifiers' => ['SELECT foo$sql$, {context:String}, foo$sql$ FROM t']; | ||
| yield 'partial dollar tag at end of input' => ['SELECT {context:String}, $column']; | ||
| yield 'dollar identifier without closing dollar' => ['SELECT $column + {context:String}']; | ||
| yield 'many distinct dollar-bearing identifiers' => [ | ||
| 'SELECT ' . implode(', ', array_map(static fn (int $i) => '$column' . $i . '$', range(0, 29_999))) | ||
| . ', {context:String} FROM t', | ||
| ]; | ||
|
|
||
| yield 'parameter after large escaped literal' => [ | ||
| "SELECT '" . str_repeat('\\x', 10_000) . "', {context:String}", | ||
| ]; | ||
|
|
||
| yield 'parameter after large block comment' => [ | ||
| 'SELECT /* ' . str_repeat('/', 10_000) . ' */ {context:String}', | ||
| ]; | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.