Skip to content

Avoid false statement splits in skipped SQL tails - #9

Merged
laodouya merged 6 commits into
masterfrom
fix/ddl-tail-semicolons
Nov 8, 2026
Merged

laodouya merged 6 commits into
masterfrom
fix/ddl-tail-semicolons

Conversation

@laodouya

@laodouya laodouya commented Nov 8, 2026 •

Copy link
Copy Markdown
Member

In skipped CREATE INDEX/EXPLAIN tails and error recovery, semicolons inside quoted strings, [bracket] identifiers or comments no longer end the statement. CovenantSQL/CovenantSQL#452 rejected EXPLAIN SELECT 'a;select 2 --' as two statements. Keep character-level skipping and partial-DDL fallback.

Remaining SQLite boundary differences, not addressed here:

  • Still split: parameter-suffix semicolons (SQLite supports suffixes after $, @, : or #, e.g. $p(;...)); EXPLAIN CREATE TRIGGER ... BEGIN ...; END; input after NUL; empty statements or trailing comments after an EXPLAIN's terminating semicolon.
  • Still merged: #p treated as a comment; parameter suffixes containing a quote, a [ or a comment opener (e.g. $p([), $p("), $p(--)); non-default backslash-escape mode.

CovenantSQL/CovenantSQL#452 with go-sqlite3-encrypt v1.13.0 fails closed on these differences through its one-statement checks and SingleStatement driver mode.

Testing

linux/amd64, Go 1.27.3: go build ./..., go vet ./..., go test -count=1 ./..., and make -B sql.go (byte-identical) pass. The two single-statement and boundary/slice regressions fail on master; Parse/leniency assertions are compatibility guards.

Current CovenantSQL develop passes go build -tags 'linux sqlite_omit_load_extension sqlite_omit_localtime' ./... and go test -count=1 -tags 'linux sqlite_omit_load_extension sqlite_omit_localtime' ./xenomint/... with a parser replace, including valid-statement execution and driver rejection checks.

Keep character-level skipping lenient while respecting quoted and
commented semicolons. Reuse the existing escape and comment rules without
validating skipped tokens or changing partial DDL acceptance.
The lexer could return an error after consuming a bracket opener or
entering a malformed HEX literal. Keep that delimiter until recovery
finishes the construct, so following statements remain visible.

Cover bracket tails, EXPLAIN, ParseNext recovery and Reader buffer
boundaries. Treat an unterminated HEX literal like other unclosed quotes.
Verify that EXPLAIN and CREATE INDEX containing quoted semicolons each
retain one original statement. Consumers enforcing one statement per
query pattern must not mistake these inputs for batches.
Malformed HEX cannot be a valid single SQLite statement, so special
recovery does not help avoid false rejections. Remove its state and
fixtures, and restore the existing ParseNext error continuation check.
Keep consumed-bracket recovery for valid SQLite identifiers.
@laodouya
laodouya merged commit ac054ec into master Nov 8, 2026
2 checks passed
@laodouya
laodouya deleted the fix/ddl-tail-semicolons branch November 8, 2026 10:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant