[FUZZER LLM TRIAGE] Expression misreads in the PostgreSQL and SQLite dialects

未關閉
  • 哪裡不對？
#2,840 0 則留言 1 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
4/5
預估耗時
3-5 天
新手友好度
48/100
Issue 類型
缺陷
描述清晰度
基本清楚
活躍度
活躍
技術堆疊
rust, sql
領域
backend-api-design, databases

研究方向

Start by reading the parser code and tests for the affected PostgreSQL or SQLite expression grammar; the issue does not name specific files or tests. Choose one row marked open and reproduce its SQL against the parser and the corresponding engine behavior. Done means the parser handles that expression as shown in the engine-reads column, with a regression test.

由索引模型根據 Issue 內容生成。

描述

Automated fuzzer PostgreSQL SQLite

Severity uses the CVSS words, Critical for silently dropped input, High for a different result, Medium for rejected valid SQL or unparseable output, Low for deep nesting or rare operator mixes, and None for a different tree with the same result.

Class Dialect SQL sqlparser reads engine reads Severity Status
C1 all SELECT 1 END; SELECT 2 SELECT 1, the rest is dropped without an error SELECT 1 AS "end"; SELECT 2 Critical #2838
C22 PostgreSQL SELECT a &>b FROM t SELECT (a &> FROM) AS t, the b is consumed with &> SELECT a &> b FROM t Critical open
C2 PostgreSQL -2 ^ 2 -(2 ^ 2) (-2) ^ 2 High #2819, #2829
C3 PostgreSQL |/ a + 3 (|/ a) + 3 |/ (a + 3) High #814
C4 PostgreSQL x = 'a' ~ 'b' (x = 'a') ~ 'b' x = ('a' ~ 'b') High open
C5 PostgreSQL a>=-1 custom operator >=- applied to 1 a >= (-1) High open
C6 PostgreSQL, SQLite a ISNULL a AS ISNULL a IS NULL High #2786
C7 SQLite ~ a * 2 ~ (a * 2) (~ a) * 2 High open
C8 SQLite a * 2 || 'x' (a * 2) || 'x' a * (2 || 'x') High open
C9 SQLite b ->> '$.n' + 1 b ->> ('$.n' + 1) (b ->> '$.n') + 1 High open
C23 SQLite 0x1F + 1 X'1F' + 1, a blob literal 31 + 1 High open
C25 SQLite a<@p operator <@ applied to p a < @p, a named parameter High open
C10 PostgreSQL OPERATOR(pg_catalog.-) 1 + 2 rejected OPERATOR(pg_catalog.-) (1 + 2) Medium open
C11 PostgreSQL 1::textor(NOT NOT 1) prints textor(NOT, NOT, 1), which PostgreSQL rejects modifier is the expression NOT (NOT 1) Medium open
C12 PostgreSQL a BETWEEN SYMMETRIC 1 AND 2 rejected BETWEEN SYMMETRIC Medium #2522
C13 SQLite a NOT NULL COLLATE BINARY = 1 rejected ((a NOT NULL) COLLATE BINARY) = 1 Medium open
C14 SQLite b NOT GLOB 'x*' rejected NOT (b GLOB 'x*') Medium open
C15 PostgreSQL a OPERATOR(pg_catalog.+) 1 ?| b a OPERATOR(pg_catalog.+) (1 ?| b) (a OPERATOR(pg_catalog.+) 1) ?| b Low open
C16 PostgreSQL $1IS NULL placeholder $1IS error trailing junk after parameter Low open
C17 all a = ANY(SELECT 1) + 1 a = ANY((SELECT 1) + 1) (a = ANY(SELECT 1)) + 1 Low #2802
C18 all - followed by 45 +, then NOT + 1 NOT read as a column nested unary operators Low open
C19 SQLite a IS NULL + 1 (a IS NULL) + 1 a IS (NULL + 1) Low open
C20 SQLite a IS NOT DISTINCT FROM 2 <> 3 a IS NOT DISTINCT FROM (2 <> 3) (a IS NOT DISTINCT FROM 2) <> 3 Low open
C21 SQLite b LIKE 'x%' = 0 b LIKE ('x%' = 0) (b LIKE 'x%') = 0 Low open
C24 PostgreSQL, SQLite NOT EXISTS (SELECT 1) = false (NOT EXISTS (SELECT 1)) = false NOT (EXISTS (SELECT 1) = false) Low open
C26 PostgreSQL a LIKE ANY (b) ::text a LIKE ANY ((b)::text) (a LIKE ANY (b))::text Low open
C27 PostgreSQL + @ 1 prints +@ 1, which PostgreSQL lexes as the single operator +@ + (@ 1) Medium #2424
C28 SQLite 0 NOT NULL + 1 prints 0 IS NOT NULL + 1, which SQLite reads as 0 IS NOT (NULL + 1) (0 NOT NULL) + 1 Medium open
主要語言
Rust
星號
3.5k
分支
805
平均合併
2 天 3 小時
30 天內合併 PR
116

環境準備

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 有 Pull Request 範本
  • 沒有貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

apache/datafusion-sqlparser-rs 的其他 Issue

查看 apache/datafusion-sqlparser-rs 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。