sparkql 1.3.4 → 1.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 995514ae40305cedb2116dafc6c98b8efb534ae3d2f31c9d48e86421e3f5c10c
-  data.tar.gz: 6162d29fb4520941edb2b53742d966fdf373418b2745f6fd1d8c1fa79432b896
+  metadata.gz: 6c51d91b09c229564b83503e11d3ca453c91f5c280307effd1120d6a33b74010
+  data.tar.gz: ea90a995aa3dbd06ae7f187437c24abb81590ff396e837ec45e531ea25408f69
 SHA512:
-  metadata.gz: c39c06894d6a7b298d4fafb3c578e6d203543c77c68ad0cf8acb9ec943c00c656e38529a7e6b2afe4cc3177b5a59b078c7ce4c193a08dea0f575bd62ee0495d7
-  data.tar.gz: fbbba23b099146c85f3c15fb82ea3bbc93fe989b156752a80137a2212b2ed64f4cf50ecb99bf06b59914f1e1f8996a65155c9cde11c025702e6b8504b083cc93
+  metadata.gz: c10a6629cc9606cdb49de2f60c64e6d0a38879c7abf4118e91fb23070eea06efa81b951a4f76daf185f5904efcbaa1b2ef4edb09a6124f24833e77865ecdd295
+  data.tar.gz: 9e073aa1c7963578f2ecf8e0a65230e7210c329a365a57e6b3fd7d4d0c7aa60e281b186e3c507ffe8f59a91fbefd16dbc9e99a9d97e8b603f4da6b1bb859c0e4

data/CHANGELOG.md

@@ -1,4 +1,10 @@
-v1.3.4, 20265-01-20
+v1.3.6, 2026-06-23
+  * [BUGFIX] Parser crash when days()/weekdays() exceed max offset
+
+v1.3.5, 2026-04-30
+ * [IMPROVEMENT] add date_date() function
+
+v1.3.4, 2026-01-20
   * [BUGFIX] Validate limit for days and weekdays
 
 v1.3.3, 2025-08-12

data/VERSION

@@ -1 +1 @@
-1.3.4
+1.3.6

data/lib/sparkql/function_resolver.rb

@@ -651,6 +651,10 @@ module Sparkql
       }
     end
 
+    def date_date(value)
+      date_datetime(value)
+    end
+
     def time_datetime(datetime)
       {
         type: :time,

data/lib/sparkql/parser_tools.rb

@@ -171,6 +171,16 @@ module Sparkql::ParserTools
   end
 
   def tokenize_multiple(lit1, lit2)
+    if lit1.nil? || lit2.nil?
+      return nil if errors?
+
+      tokenizer_error(token: @lexer.last_field,
+                      message: 'Invalid value in field list.',
+                      status: :fatal,
+                      syntax: true)
+      return nil
+    end
+
     final_type = lit1[:type]
     if lit1[:type] != lit2[:type]
       final_type = coercible_types(lit1[:type], lit2[:type])
@@ -224,15 +234,17 @@ module Sparkql::ParserTools
     resolver = function_resolver(name, args)
     resolver.validate
     if resolver.errors?
-      tokenizer_error(token: @lexer.last_field,
-                      message: "Error parsing function #{resolver.errors.join(',')}",
-                      status: :fatal,
-                      syntax: true)
-      nil
-    else
-      result = resolver.call
-      result.nil? ? result : result.merge(condition: "#{name}(#{condition_list.join(',')})")
+      report_function_resolver_errors(resolver)
+      return nil
     end
+
+    result = resolver.call
+    if result.nil?
+      report_function_resolver_errors(resolver) if resolver.errors?
+      return nil
+    end
+
+    result.merge(condition: "#{name}(#{condition_list.join(',')})")
   end
 
   def tokenize_arithmetic(lhs, operator, rhs)
@@ -448,4 +460,16 @@ module Sparkql::ParserTools
   def offset
     @offset ||= current_timestamp.strftime('%:z')
   end
+
+  private
+
+  def report_function_resolver_errors(resolver)
+    resolver.errors.each do |error|
+      tokenizer_error(token: error.token || @lexer.last_field,
+                      message: error.message,
+                      status: error.status,
+                      syntax: error.syntax?,
+                      constraint: error.constraint?)
+    end
+  end
 end

data/test/unit/parser_test.rb

@@ -1232,6 +1232,18 @@ class ParserTest < Test::Unit::TestCase
     assert_equal 0, expressions.last[:block_group]
   end
 
+  test 'oversized days() in Bt range returns parser error instead of raising' do
+    [
+      'OriginalEntryTimestamp Bt days(0),days(365001)',
+      'OpenHouses Bt days(0),days(9223372036854775807)'
+    ].each do |filter|
+      @parser = Parser.new
+      assert_nothing_raised { @parser.parse(filter) }
+      assert @parser.fatal_errors?, "Expected fatal error for #{filter}"
+      assert_match(/max offset/i, @parser.errors.first.message)
+    end
+  end
+
   private
 
   def parser_errors(filter)

data/test/unit/security_test.rb

@@ -0,0 +1,150 @@
+require 'test_helper'
+
+# Security regression tests covering SQL injection attack vectors identified
+# during audit. The parser is responsible for rejecting malformed input and
+# producing type-safe output. Consumers of parser output must still use
+# parameterized queries and quote field identifiers — see comments below.
+class SecurityTest < Test::Unit::TestCase
+  include Sparkql
+
+  def setup
+    @parser = Parser.new
+  end
+
+  # --- String value injection ---
+
+  test 'rejects unclosed string literals' do
+    assert_parse_error "City Eq 'Fargo"
+    assert_parse_error "City Eq Fargo'"
+  end
+
+  test 'rejects double-quote SQL injection in string values' do
+    # SparkQL only recognises \' as an escape sequence inside strings.
+    # A bare '' does not escape the quote — the lexer matches 'test' and
+    # the leftover 'injection' token causes a parse error.
+    assert_parse_error "City Eq 'test''injection'"
+  end
+
+  test 'string with backslash-escaped quote parses and escapes safely' do
+    # \' is the valid SparkQL escape for a literal apostrophe. :value retains
+    # outer quotes; character_escape strips them and unescapes \' to '.
+    # The resulting value contains a single quote — consumers MUST use bind
+    # parameters, not string interpolation, when building SQL from this value.
+    expressions = @parser.parse("City Eq 'O\\'Brien'")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal "O'Brien", @parser.character_escape(expressions.first[:value])
+  end
+
+  test 'sql payload inside valid sparkql string is accepted but value is raw' do
+    # The lexer correctly accepts 'val\'; DROP TABLE t; --' as a character
+    # literal (\' is a valid escape sequence). character_escape returns the raw
+    # string including the injected SQL — safe only with parameterized queries.
+    expressions = @parser.parse("City Eq 'val\\'; DROP TABLE t; --'")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal "val'; DROP TABLE t; --", @parser.character_escape(expressions.first[:value])
+  end
+
+  test 'plain string :value retains outer quotes before character_escape' do
+    expressions = @parser.parse("City Eq 'Fargo'")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal "'Fargo'", expressions.first[:value]
+    assert_equal :character, expressions.first[:type]
+    assert_equal 'Fargo', @parser.character_escape(expressions.first[:value])
+  end
+
+  # --- Numeric/decimal injection ---
+
+  test 'rejects sql keywords appended after integer token' do
+    assert_parse_error "Price Eq 100; DROP TABLE listings"
+    assert_parse_error "Price Eq 100 UNION SELECT"
+  end
+
+  test 'integer values are coerced to integers preventing non-numeric injection' do
+    expressions = @parser.parse("Price Eq 100")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal '100', expressions.first[:value]
+    assert_equal :integer, expressions.first[:type]
+  end
+
+  test 'decimal values are stored as strings preventing non-numeric injection' do
+    expressions = @parser.parse("Price Eq 100.50")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal '100.50', expressions.first[:value]
+    assert_equal :decimal, expressions.first[:type]
+  end
+
+  # --- Operator injection ---
+
+  test 'rejects sql operators that are not in the sparkql whitelist' do
+    assert_parse_error "City LIKE '%Fargo%'"
+    assert_parse_error "Price > 100"
+    assert_parse_error "Price < 100"
+    assert_parse_error "Price != 100"
+  end
+
+  test 'rejects sql keywords used as conjunctions' do
+    # OR/AND lowercased is valid SparkQL, but 1=1 is not a valid expression.
+    # Uppercase SQL keywords like UNION are rejected entirely.
+    assert_parse_error "City Eq 'Fargo' UNION SELECT City FROM listings"
+    assert_parse_error "City Eq 'Fargo' OR 1=1"
+    assert_parse_error "City Eq 'Fargo' AND 1=1"
+  end
+
+  # --- Function name injection ---
+
+  test 'rejects function names not in the supported functions whitelist' do
+    assert_parse_error "City Eq unknownfn('Fargo')"
+    assert_parse_error "City Eq exec('xp_cmdshell')"
+    assert_parse_error "City Eq sleep(10)"
+  end
+
+  # --- Custom field name handling ---
+
+  test 'custom field regex rejects names starting with dollar sign or period' do
+    assert_parse_error '"$BadGroup"."Field" Eq 10'
+    assert_parse_error '"Group"."$BadField" Eq 10'
+    assert_parse_error '"Group".".BadField" Eq 10'
+    assert_parse_error '"Group.Bad"."Field" Eq 10'
+    assert_parse_error '"Group"."Field.Sub" Eq 10'
+    assert_parse_error '""."" Eq 10'
+  end
+
+  test 'valid custom field names parse and field is returned verbatim' do
+    filter = '"General Property Description"."Taxes" Lt 500.0'
+    expressions = @parser.parse(filter)
+    assert !@parser.errors?, @parser.errors.inspect
+    assert expressions.first[:custom_field]
+    # The field value is returned as-is with its surrounding double-quotes.
+    # Consumers MUST validate this against allowed metadata and/or quote it
+    # as a SQL identifier before using it in a query — never interpolate directly.
+    assert_equal '"General Property Description"."Taxes"', expressions.first[:field]
+  end
+
+  test 'custom field name containing sql-significant characters is returned verbatim' do
+    # SparkQL allows characters like ; and ' inside double-quoted field names.
+    # The CUSTOM_FIELD regex does not strip these — that is the consumer's job.
+    filter = %("It's a field"."Value" Eq 10)
+    expressions = @parser.parse(filter)
+    assert !@parser.errors?, @parser.errors.inspect
+    assert expressions.first[:custom_field]
+    assert expressions.first[:field].include?("It's a field"), \
+      "Expected field to contain the group name, got: #{expressions.first[:field].inspect}"
+  end
+
+  # --- Date/datetime injection ---
+
+  test 'valid dates parse to their string representation' do
+    expressions = @parser.parse("DateField Eq 2023-06-15")
+    assert !@parser.errors?, @parser.errors.inspect
+    assert_equal '2023-06-15', expressions.first[:value]
+    assert_equal :date, expressions.first[:type]
+  end
+
+  private
+
+  def assert_parse_error(filter)
+    parser = Parser.new
+    parser.parse(filter)
+    assert parser.errors?, "Expected parse error for: #{filter.inspect}"
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sparkql
 version: !ruby/object:Gem::Version
-  version: 1.3.4
+  version: 1.3.6
 platform: ruby
 authors:
 - Wade McEwen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-01-20 00:00:00.000000000 Z
+date: 2026-06-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: georuby
@@ -155,6 +155,7 @@ files:
 - test/unit/lexer_test.rb
 - test/unit/parser_compatability_test.rb
 - test/unit/parser_test.rb
+- test/unit/security_test.rb
 homepage: ''
 licenses:
 - Apache 2.0