sparkql 1.3.3 → 1.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1fb6060ec97e59958c12e0ed3338540afa180bf28eab0224af3ffef568dbf469
-  data.tar.gz: 982d3956830686faeb210e6abf52125d18d4d68fa0d231b00a251a4876e1bd14
+  metadata.gz: ee4b94747c3d671e7ceac9675caaebaf3d8661a4a9316327719e7221f439b3bc
+  data.tar.gz: '09a7eddd5cd21a23d2083c8312f0a1bec48a0f21938c0871538cdb08ef52d1d3'
 SHA512:
-  metadata.gz: 6754d10ca449bbd3467127a8470bb4233dd00b5162984ca636bcd93aff41743b25ace78fdd30ba77cbb6a79bef55d36118f67f2102b676ca9184db04c2437c01
-  data.tar.gz: d337d7169ceb202c6f4d8a066196c472404cccf5e1b6f0fc13bf07a4fba62fa6d135c04bfc017544c73fb84ca1834f5d06c78bbf5ee2848ac16b06372b09b711
+  metadata.gz: 67b098969f33bf5eaa19277d3d202687c8ceddf4183d4f54cb703cdb7b5ed3aff934a201a3e238226a27bfcecce9b2c58e31e2ce64f76fa0f03babf23b980291
+  data.tar.gz: 42db5ca0692fca37b627562870641af084f539c64909fb8858e8bc872d4371d365621fe502cbba8289dbd0ea47e13cdc80df24c83172ebc3d88a92ec1291e64c

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+v1.3.5, 2026-04-30
+ * [IMPROVEMENT] add date_date() function
+
+v1.3.4, 2026-01-20
+  * [BUGFIX] Validate limit for days and weekdays
 
 v1.3.3, 2025-08-12
 -------------------

data/VERSION

@@ -1 +1 @@
-1.3.3
+1.3.5

data/lib/sparkql/function_resolver.rb

@@ -21,6 +21,7 @@ module Sparkql
     VALID_REGEX_FLAGS = ['', 'i'].freeze
     MIN_DATE_TIME = Time.new(1970, 1, 1, 0, 0, 0, '+00:00').iso8601
     MAX_DATE_TIME = Time.new(9999, 12, 31, 23, 59, 59, '+00:00').iso8601
+    MAX_DAYS = (365 * 1000).freeze # 1000 years ought to cover most cases
     VALID_CAST_TYPES = %i[field character decimal integer].freeze
 
     SUPPORTED_FUNCTIONS = {
@@ -43,16 +44,16 @@ module Sparkql
       regex: {
         args: [:character],
         opt_args: [{
-          type: :character,
-          default: ''
-        }],
+                     type: :character,
+                     default: ''
+                   }],
         return_type: :character
       },
       substring: {
         args: [%i[field character], :integer],
         opt_args: [{
-          type: :integer
-        }],
+                     type: :integer
+                   }],
         resolve_for_type: true,
         return_type: :character
       },
@@ -526,6 +527,15 @@ module Sparkql
 
     # Offset the current timestamp by a number of days
     def days(number_of_days)
+      if number_of_days.abs > MAX_DAYS
+        @errors << Sparkql::ParserError.new(token: number_of_days,
+                                            message: "Function call 'days' max offset #{MAX_DAYS} days",
+                                            status: :fatal,
+                                            syntax: false,
+                                            constraint: true)
+        return
+      end
+
       # date calculated as the offset from midnight tommorrow. Zero will provide values for all times
       # today.
       d = current_date + number_of_days
@@ -536,6 +546,15 @@ module Sparkql
     end
 
     def weekdays(number_of_days)
+      if number_of_days.abs > MAX_DAYS
+        @errors << Sparkql::ParserError.new(token: number_of_days,
+                                            message: "Function call 'weekdays' max offset #{MAX_DAYS} days",
+                                            status: :fatal,
+                                            syntax: false,
+                                            constraint: true)
+        return
+      end
+
       today = current_date
       weekend_start = today.saturday? || today.sunday?
       direction = number_of_days.positive? ? 1 : -1
@@ -632,6 +651,10 @@ module Sparkql
       }
     end
 
+    def date_date(value)
+      date_datetime(value)
+    end
+
     def time_datetime(datetime)
       {
         type: :time,

data/test/unit/function_resolver_test.rb

@@ -445,6 +445,24 @@ class FunctionResolverTest < Test::Unit::TestCase
     end
   end
 
+  test 'days - exceed max' do
+    f = FunctionResolver.new('days',
+                             [{ type: :integer, value: 365_001 }],
+                             current_timestamp: EXAMPLE_DATE)
+    f.validate
+    assert !f.errors?
+    assert_nil f.call
+    assert f.errors?, "function 'days' limit 365000"
+
+    f = FunctionResolver.new('days',
+                             [{ type: :integer, value: -365_001 }],
+                             current_timestamp: EXAMPLE_DATE)
+    f.validate
+    assert !f.errors?
+    assert_nil f.call
+    assert f.errors?, "function 'days' limit 365000"
+  end
+
   test 'weekdays()' do
     friday = Date.new(2012, 10, 19)
     saturday = Date.new(2012, 10, 20)
@@ -514,6 +532,24 @@ class FunctionResolverTest < Test::Unit::TestCase
     end
   end
 
+  test 'weekdays - exceed max' do
+    f = FunctionResolver.new('weekdays',
+                             [{ type: :integer, value: 365_001 }],
+                             current_timestamp: EXAMPLE_DATE)
+    f.validate
+    assert !f.errors?
+    assert_nil f.call
+    assert f.errors?, "function 'weekdays' limit 365000"
+
+    f = FunctionResolver.new('weekdays',
+                             [{ type: :integer, value: -365_001 }],
+                             current_timestamp: EXAMPLE_DATE)
+    f.validate
+    assert !f.errors?
+    assert_nil f.call
+    assert f.errors?, "function 'weekdays' limit 365000"
+  end
+
   test 'months()' do
     f = FunctionResolver.new('months',
                              [{ type: :integer, value: 3 }],

data/test/unit/security_test.rb

@@ -0,0 +1,150 @@
+require 'test_helper'
+
+# Security regression tests covering SQL injection attack vectors identified
+# during audit. The parser is responsible for rejecting malformed input and
+# producing type-safe output. Consumers of parser output must still use
+# parameterized queries and quote field identifiers — see comments below.
+class SecurityTest < Test::Unit::TestCase
+  include Sparkql
+
+  def setup
+    @parser = Parser.new
+  end
+
+  # --- String value injection ---
+
+  test 'rejects unclosed string literals' do
+    assert_parse_error "City Eq 'Fargo"
+    assert_parse_error "City Eq Fargo'"
+  end
+
+  test 'rejects double-quote SQL injection in string values' do
+    # SparkQL only recognises \' as an escape sequence inside strings.
+    # A bare '' does not escape the quote — the lexer matches 'test' and
+    # the leftover 'injection' token causes a parse error.
+    assert_parse_error "City Eq 'test''injection'"
+  end
+
+  test 'string with backslash-escaped quote parses and escapes safely' do
+    # \' is the valid SparkQL escape for a literal apostrophe. :value retains
+    # outer quotes; character_escape strips them and unescapes \' to '.
+    # The resulting value contains a single quote — consumers MUST use bind
+    # parameters, not string interpolation, when building SQL from this value.
+    expressions = @parser.parse("City Eq 'O\\'Brien'")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal "O'Brien", @parser.character_escape(expressions.first[:value])
+  end
+
+  test 'sql payload inside valid sparkql string is accepted but value is raw' do
+    # The lexer correctly accepts 'val\'; DROP TABLE t; --' as a character
+    # literal (\' is a valid escape sequence). character_escape returns the raw
+    # string including the injected SQL — safe only with parameterized queries.
+    expressions = @parser.parse("City Eq 'val\\'; DROP TABLE t; --'")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal "val'; DROP TABLE t; --", @parser.character_escape(expressions.first[:value])
+  end
+
+  test 'plain string :value retains outer quotes before character_escape' do
+    expressions = @parser.parse("City Eq 'Fargo'")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal "'Fargo'", expressions.first[:value]
+    assert_equal :character, expressions.first[:type]
+    assert_equal 'Fargo', @parser.character_escape(expressions.first[:value])
+  end
+
+  # --- Numeric/decimal injection ---
+
+  test 'rejects sql keywords appended after integer token' do
+    assert_parse_error "Price Eq 100; DROP TABLE listings"
+    assert_parse_error "Price Eq 100 UNION SELECT"
+  end
+
+  test 'integer values are coerced to integers preventing non-numeric injection' do
+    expressions = @parser.parse("Price Eq 100")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal '100', expressions.first[:value]
+    assert_equal :integer, expressions.first[:type]
+  end
+
+  test 'decimal values are stored as strings preventing non-numeric injection' do
+    expressions = @parser.parse("Price Eq 100.50")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal '100.50', expressions.first[:value]
+    assert_equal :decimal, expressions.first[:type]
+  end
+
+  # --- Operator injection ---
+
+  test 'rejects sql operators that are not in the sparkql whitelist' do
+    assert_parse_error "City LIKE '%Fargo%'"
+    assert_parse_error "Price > 100"
+    assert_parse_error "Price < 100"
+    assert_parse_error "Price != 100"
+  end
+
+  test 'rejects sql keywords used as conjunctions' do
+    # OR/AND lowercased is valid SparkQL, but 1=1 is not a valid expression.
+    # Uppercase SQL keywords like UNION are rejected entirely.
+    assert_parse_error "City Eq 'Fargo' UNION SELECT City FROM listings"
+    assert_parse_error "City Eq 'Fargo' OR 1=1"
+    assert_parse_error "City Eq 'Fargo' AND 1=1"
+  end
+
+  # --- Function name injection ---
+
+  test 'rejects function names not in the supported functions whitelist' do
+    assert_parse_error "City Eq unknownfn('Fargo')"
+    assert_parse_error "City Eq exec('xp_cmdshell')"
+    assert_parse_error "City Eq sleep(10)"
+  end
+
+  # --- Custom field name handling ---
+
+  test 'custom field regex rejects names starting with dollar sign or period' do
+    assert_parse_error '"$BadGroup"."Field" Eq 10'
+    assert_parse_error '"Group"."$BadField" Eq 10'
+    assert_parse_error '"Group".".BadField" Eq 10'
+    assert_parse_error '"Group.Bad"."Field" Eq 10'
+    assert_parse_error '"Group"."Field.Sub" Eq 10'
+    assert_parse_error '""."" Eq 10'
+  end
+
+  test 'valid custom field names parse and field is returned verbatim' do
+    filter = '"General Property Description"."Taxes" Lt 500.0'
+    expressions = @parser.parse(filter)
+    assert !@parser.errors?, @parser.errors.inspect
+    assert expressions.first[:custom_field]
+    # The field value is returned as-is with its surrounding double-quotes.
+    # Consumers MUST validate this against allowed metadata and/or quote it
+    # as a SQL identifier before using it in a query — never interpolate directly.
+    assert_equal '"General Property Description"."Taxes"', expressions.first[:field]
+  end
+
+  test 'custom field name containing sql-significant characters is returned verbatim' do
+    # SparkQL allows characters like ; and ' inside double-quoted field names.
+    # The CUSTOM_FIELD regex does not strip these — that is the consumer's job.
+    filter = %("It's a field"."Value" Eq 10)
+    expressions = @parser.parse(filter)
+    assert !@parser.errors?, @parser.errors.inspect
+    assert expressions.first[:custom_field]
+    assert expressions.first[:field].include?("It's a field"), \
+      "Expected field to contain the group name, got: #{expressions.first[:field].inspect}"
+  end
+
+  # --- Date/datetime injection ---
+
+  test 'valid dates parse to their string representation' do
+    expressions = @parser.parse("DateField Eq 2023-06-15")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal '2023-06-15', expressions.first[:value]
+    assert_equal :date, expressions.first[:type]
+  end
+
+  private
+
+  def assert_parse_error(filter)
+    parser = Parser.new
+    parser.parse(filter)
+    assert parser.errors?, "Expected parse error for: #{filter.inspect}"
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sparkql
 version: !ruby/object:Gem::Version
-  version: 1.3.3
+  version: 1.3.5
 platform: ruby
 authors:
 - Wade McEwen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-08-19 00:00:00.000000000 Z
+date: 2026-05-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: georuby
@@ -155,6 +155,7 @@ files:
 - test/unit/lexer_test.rb
 - test/unit/parser_compatability_test.rb
 - test/unit/parser_test.rb
+- test/unit/security_test.rb
 homepage: ''
 licenses:
 - Apache 2.0