[FUZZER LLM TRIAGE] Expression misreads in the PostgreSQL and SQLite dialects

Aperta
  • Qualcosa non va?
#2,840 0 commenti 1 reazione 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust, sql
Ambito
backend-api-design, databases

Direzione di ricerca

Start by reading the parser code and tests for the affected PostgreSQL or SQLite expression grammar; the issue does not name specific files or tests. Choose one row marked open and reproduce its SQL against the parser and the corresponding engine behavior. Done means the parser handles that expression as shown in the engine-reads column, with a regression test.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Automated fuzzer PostgreSQL SQLite

Severity uses the CVSS words, Critical for silently dropped input, High for a different result, Medium for rejected valid SQL or unparseable output, Low for deep nesting or rare operator mixes, and None for a different tree with the same result.

Class Dialect SQL sqlparser reads engine reads Severity Status
C1 all SELECT 1 END; SELECT 2 SELECT 1, the rest is dropped without an error SELECT 1 AS "end"; SELECT 2 Critical #2838
C22 PostgreSQL SELECT a &>b FROM t SELECT (a &> FROM) AS t, the b is consumed with &> SELECT a &> b FROM t Critical open
C2 PostgreSQL -2 ^ 2 -(2 ^ 2) (-2) ^ 2 High #2819, #2829
C3 PostgreSQL |/ a + 3 (|/ a) + 3 |/ (a + 3) High #814
C4 PostgreSQL x = 'a' ~ 'b' (x = 'a') ~ 'b' x = ('a' ~ 'b') High open
C5 PostgreSQL a>=-1 custom operator >=- applied to 1 a >= (-1) High open
C6 PostgreSQL, SQLite a ISNULL a AS ISNULL a IS NULL High #2786
C7 SQLite ~ a * 2 ~ (a * 2) (~ a) * 2 High open
C8 SQLite a * 2 || 'x' (a * 2) || 'x' a * (2 || 'x') High open
C9 SQLite b ->> '$.n' + 1 b ->> ('$.n' + 1) (b ->> '$.n') + 1 High open
C23 SQLite 0x1F + 1 X'1F' + 1, a blob literal 31 + 1 High open
C25 SQLite a<@p operator <@ applied to p a < @p, a named parameter High open
C10 PostgreSQL OPERATOR(pg_catalog.-) 1 + 2 rejected OPERATOR(pg_catalog.-) (1 + 2) Medium open
C11 PostgreSQL 1::textor(NOT NOT 1) prints textor(NOT, NOT, 1), which PostgreSQL rejects modifier is the expression NOT (NOT 1) Medium open
C12 PostgreSQL a BETWEEN SYMMETRIC 1 AND 2 rejected BETWEEN SYMMETRIC Medium #2522
C13 SQLite a NOT NULL COLLATE BINARY = 1 rejected ((a NOT NULL) COLLATE BINARY) = 1 Medium open
C14 SQLite b NOT GLOB 'x*' rejected NOT (b GLOB 'x*') Medium open
C15 PostgreSQL a OPERATOR(pg_catalog.+) 1 ?| b a OPERATOR(pg_catalog.+) (1 ?| b) (a OPERATOR(pg_catalog.+) 1) ?| b Low open
C16 PostgreSQL $1IS NULL placeholder $1IS error trailing junk after parameter Low open
C17 all a = ANY(SELECT 1) + 1 a = ANY((SELECT 1) + 1) (a = ANY(SELECT 1)) + 1 Low #2802
C18 all - followed by 45 +, then NOT + 1 NOT read as a column nested unary operators Low open
C19 SQLite a IS NULL + 1 (a IS NULL) + 1 a IS (NULL + 1) Low open
C20 SQLite a IS NOT DISTINCT FROM 2 <> 3 a IS NOT DISTINCT FROM (2 <> 3) (a IS NOT DISTINCT FROM 2) <> 3 Low open
C21 SQLite b LIKE 'x%' = 0 b LIKE ('x%' = 0) (b LIKE 'x%') = 0 Low open
C24 PostgreSQL, SQLite NOT EXISTS (SELECT 1) = false (NOT EXISTS (SELECT 1)) = false NOT (EXISTS (SELECT 1) = false) Low open
C26 PostgreSQL a LIKE ANY (b) ::text a LIKE ANY ((b)::text) (a LIKE ANY (b))::text Low open
C27 PostgreSQL + @ 1 prints +@ 1, which PostgreSQL lexes as the single operator +@ + (@ 1) Medium #2424
C28 SQLite 0 NOT NULL + 1 prints 0 IS NOT NULL + 1, which SQLite reads as 0 IS NOT (NULL + 1) (0 NOT NULL) + 1 Medium open
Lingua principale
Rust
Stelle
3.5k
Fork
805
Merge medio
2g 3h
PR unite (30g)
116

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/datafusion-sqlparser-rs

Tutte le issue di apache/datafusion-sqlparser-rs

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.