woods 1.6.1 → 2.0.0.beta2

data/lib/woods/console/sql_noise_stripper.rb

@@ -24,7 +24,7 @@ module Woods
     #   SqlNoiseStripper.strip_literals("SELECT 'it\\'s ok' FROM t", dialect: :mysql)
     #   # => "SELECT '' FROM t"
     #
-    module SqlNoiseStripper
+    module SqlNoiseStripper # rubocop:disable Metrics/ModuleLength
       # Strips SQL line comments (`-- ...`) and block comments (`/* ... */`).
       # Line comments are stripped to (but not including) the newline so that
       # newline-separated statement structure is preserved for callers that
@@ -59,8 +59,7 @@ module Woods
       #     Dollar-quoted strings (`$$...$$`, `$tag$...$tag$`) are also stripped.
       #   - `:mysql` — single-quoted strings support both `\'` (backslash-escape)
       #     and `''` (doubled-quote) as apostrophe escapes. Dollar-quoted strings
-      #     are also stripped (MySQL does not use them, but stripping them is
-      #     harmless and keeps the two dialects consistent).
+      #     are not recognized by the combined MySQL security scanner.
       # @return [String] a new string with all string literals replaced by `''`
       # @raise [ArgumentError] if an unsupported dialect is provided
       DOLLAR_QUOTED = /\$(\w*)\$.*?\$\1\$/m
@@ -97,13 +96,29 @@ module Woods
       # never under-detect: an unterminated literal is treated as an ordinary
       # character rather than swallowing the rest of the statement.
       #
+      # `#` opens a MySQL line comment, mirroring `--`, but only under the
+      # `:mysql` dialect — PostgreSQL does not treat `#` as a comment, and
+      # collapsing it there would hide SQL that a real PostgreSQL server
+      # still executes. A MySQL `/*! ... */` executable comment is left
+      # untouched (not treated as a comment at all, under either dialect):
+      # MySQL runs its body, so it must stay visible to every downstream
+      # scan; leaving it visible under `:postgres` too is over-detection at
+      # worst, never under-detection, on a server where it really is inert.
+      # An ordinary `/* ... */` block comment is replaced by a single
+      # newline rather than vanishing outright, mirroring how a `--`/`#`
+      # line comment's own trailing newline survives: SqlValidator's
+      # statement-leader scan needs a durable marker showing a comment sat
+      # here so a comment-hidden statement (`SELECT 1 /*;*/ DELETE ...`)
+      # still reads as following a boundary once comments are gone.
+      #
       # @param sql [String] the SQL string to process
       # @param dialect [Symbol] `:postgres` (default) or `:mysql` — controls
-      #   single-quote escape rules (see {.strip_literals}).
+      #   single-quote escape rules (see {.strip_literals}) and whether `#`
+      #   opens a line comment. MySQL quote flags reflect session sql_mode.
       # @return [String] a new string with comments removed and every string
       #   literal replaced by `''`
       # @raise [ArgumentError] if an unsupported dialect is provided
-      def self.strip_noise(sql, dialect: :postgres) # rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity,Metrics/AbcSize
+      def self.strip_noise(sql, dialect: :postgres, ansi_quotes: false, no_backslash_escapes: false) # rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity,Metrics/AbcSize
         unless SUPPORTED_DIALECTS.include?(dialect)
           raise ArgumentError, "Unknown dialect #{dialect.inspect}. Supported: #{SUPPORTED_DIALECTS.inspect}"
         end
@@ -117,7 +132,10 @@ module Woods
           ch = sql[i]
 
           if ch == "'"
-            close = single_quote_end(sql, i, mysql: mysql)
+            close = single_quote_end(
+              sql, i,
+              backslash_escapes: (mysql && !no_backslash_escapes) || (!mysql && postgres_escape_string?(sql, i))
+            )
             if close
               out << "''"
               i = close
@@ -126,7 +144,33 @@ module Woods
               out << ch
               i += 1
             end
-          elsif ch == '$' && (tag = dollar_tag_at(sql, i))
+          elsif ch == '"'
+            close = quoted_span_end(sql, i, quote: '"',
+                                            backslash_escapes: mysql && !ansi_quotes && !no_backslash_escapes)
+            if close
+              # MySQL parses double quotes as strings unless ANSI_QUOTES is
+              # enabled. Treating them as literals prevents a `#` inside the
+              # value from hiding live SQL. PostgreSQL uses them for
+              # identifiers, which must remain visible to table/column scans.
+              out << double_quote_replacement(sql, i, close, mysql: mysql && !ansi_quotes)
+              i = close
+            else
+              out << ch
+              i += 1
+            end
+          elsif mysql && ch == '`'
+            close = quoted_span_end(sql, i, quote: '`', backslash_escapes: false)
+            if close
+              # Backticks delimit identifiers. Preserve the token for table
+              # and protected-column scans while shielding comment markers
+              # inside it from the noise scanner.
+              out << sql[i...close]
+              i = close
+            else
+              out << ch
+              i += 1
+            end
+          elsif !mysql && ch == '$' && !preceded_by_word_char?(sql, i) && (tag = dollar_tag_at(sql, i))
             close = sql.index(tag, i + tag.length)
             if close
               out << "''"
@@ -135,12 +179,18 @@ module Woods
               out << ch
               i += 1
             end
-          elsif ch == '-' && sql[i + 1] == '-'
+          elsif dash_comment?(sql, i, mysql: mysql) || (mysql && ch == '#')
             nl = sql.index("\n", i)
             i = nl || len
-          elsif ch == '/' && sql[i + 1] == '*'
+          elsif ch == '/' && sql[i + 1] == '*' && sql[i + 2] != '!'
             close = sql.index('*/', i + 2)
             if close
+              # Preserve a newline in place of the removed comment, mirroring
+              # line comments (see class docs): callers that check for
+              # statement structure (SqlValidator's statement-leader scan)
+              # need a survivable marker showing a comment sat here, the
+              # same way a `--`/`#` comment's own trailing newline does.
+              out << "\n"
               i = close + 2
             else
               # Unterminated block comment: never under-detect. Leave it in
@@ -158,6 +208,25 @@ module Woods
         out
       end
 
+      # Session modes change MySQL quoting without changing the adapter name.
+      # Security consumers must reject SQL unsafe under any supported combination.
+      MYSQL_QUOTE_MODES = [false, true].product([false, true]).map do |ansi, no_backslash|
+        { ansi_quotes: ansi, no_backslash_escapes: no_backslash }.freeze
+      end.freeze
+
+      def self.security_views(sql, dialect:, mysql_modes: nil)
+        modes = dialect == :mysql && mysql_modes.nil? ? MYSQL_QUOTE_MODES : [mysql_modes || {}]
+        modes.map { |mode| strip_noise(sql, dialect: dialect, **mode) }.uniq
+      end
+
+      # MySQL requires whitespace/control after --; otherwise it is subtraction.
+      def self.dash_comment?(sql, index, mysql:)
+        return false unless sql[index, 2] == '--'
+
+        !mysql || sql[index + 2].nil? || sql[index + 2].match?(/[[:space:][:cntrl:]]/)
+      end
+      private_class_method :dash_comment?
+
       # Regexp matching a PostgreSQL dollar-quote opening tag (`$$` or
       # `$tag$`) at the start of the given slice.
       DOLLAR_TAG = /\A\$\w*\$/
@@ -172,29 +241,69 @@ module Woods
       end
       private_class_method :dollar_tag_at
 
+      # Whether the character immediately before +index+ is a word character
+      # (`\w`). PostgreSQL allows `$` inside identifiers (`x$a$`), so a `$`
+      # is only a candidate dollar-quote opener when it does NOT follow an
+      # identifier character — otherwise `x$a$ FROM blocked, (SELECT 1 AS
+      # z$a$)` gets misread as one dollar-quoted literal spanning the real
+      # FROM clause.
+      #
+      # @api private
+      def self.preceded_by_word_char?(sql, index)
+        index.positive? && sql[index - 1].match?(/\w/)
+      end
+      private_class_method :preceded_by_word_char?
+
       # Return the index just past the closing quote of the single-quoted
       # literal that opens at +start+, honoring `''` (both dialects) and `\'`
       # (MySQL only) escapes. Returns nil when the literal is unterminated.
       #
       # @api private
-      def self.single_quote_end(sql, start, mysql:)
+      def self.single_quote_end(sql, start, backslash_escapes:)
+        quoted_span_end(sql, start, quote: "'", backslash_escapes: backslash_escapes)
+      end
+      private_class_method :single_quote_end
+
+      def self.double_quote_replacement(sql, start, close, mysql:)
+        mysql ? "''" : sql[start...close]
+      end
+      private_class_method :double_quote_replacement
+
+      # Return the index just past a quoted span. Doubled delimiters escape
+      # themselves in every supported dialect; MySQL strings/identifiers and
+      # PostgreSQL E-strings additionally honor backslash escapes.
+      #
+      # @api private
+      def self.quoted_span_end(sql, start, quote:, backslash_escapes:)
         i = start + 1
         len = sql.length
         while i < len
           c = sql[i]
-          if mysql && c == '\\'
+          if backslash_escapes && c == '\\'
             i += 2
-          elsif c == "'"
-            return i + 1 unless sql[i + 1] == "'" # closing quote
+          elsif c == quote
+            return i + 1 unless sql[i + 1] == quote # closing delimiter
 
-            i += 2 # doubled-quote escape — literal continues
+            i += 2 # doubled-delimiter escape — span continues
           else
             i += 1
           end
         end
         nil
       end
-      private_class_method :single_quote_end
-    end
+      private_class_method :quoted_span_end
+
+      # PostgreSQL E'...' strings opt into C-style backslash escapes. The E
+      # must begin a token; an identifier ending in e immediately before a
+      # quote is not an escape-string prefix.
+      #
+      # @api private
+      def self.postgres_escape_string?(sql, quote_index)
+        return false unless quote_index.positive? && sql[quote_index - 1].match?(/[eE]/)
+
+        quote_index < 2 || !sql[quote_index - 2].match?(/[A-Za-z0-9_$]/)
+      end
+      private_class_method :postgres_escape_string?
+    end # rubocop:enable Metrics/ModuleLength
   end
 end

data/lib/woods/console/sql_table_scanner.rb

@@ -46,7 +46,7 @@ module Woods
             "(?<jschema_dq>[^"]+)" |
             (?<jschema_bare>\w+)
           )
-          \.
+          \s* \. \s*
         )?
         (?:
           `(?<backtick>[^`]+)` |
@@ -89,7 +89,7 @@ module Woods
             "(?<schema_dq>[^"]+)" |
             (?<schema_bare>\w+)
           )
-          \.
+          \s* \. \s*
         )?
         (?:
           `(?<backtick>[^`]+)` |
@@ -104,43 +104,93 @@ module Woods
       # first via #strip.
       ONLY_PREFIX = /\AONLY\s+/i
 
+      # Matches a MySQL executable comment (`/*!...*/` or the version-guarded
+      # `/*!NNNNN...*/`), capturing the body. Mirrors
+      # SqlValidator::EXECUTABLE_COMMENT_PATTERN — {SqlNoiseStripper}
+      # deliberately leaves these markers in place because their meaning is
+      # version-dependent; .executable_comment_views scans both of their
+      # possible semantics.
+      EXECUTABLE_COMMENT_PATTERN = %r{/\*!(?:\d{5})?(.*?)\*/}m
+
+      # Matches the standalone SQL `TABLE name` statement (PostgreSQL, and
+      # MySQL 8.0.19+) — shorthand for `SELECT * FROM name`. It appears as a
+      # full statement, inside a CTE body (`WITH x AS (TABLE blocked) ...`),
+      # or as a FROM-clause subquery (`FROM (TABLE blocked) AS t`), so it is
+      # scanned independently of FROM_CLAUSE/JOIN_REFERENCE rather than as
+      # part of either. The identifier grammar mirrors LEAD_IDENT.
+      TABLE_STATEMENT = /
+        \bTABLE\s+
+        (?:ONLY\s+)?
+        (?:
+          (?:
+            `(?<schema_bt>[^`]+)` |
+            "(?<schema_dq>[^"]+)" |
+            (?<schema_bare>\w+)
+          )
+          \s* \. \s*
+        )?
+        (?:
+          `(?<backtick>[^`]+)` |
+          "(?<double>[^"]+)"   |
+          (?<bare>\w+(?:\.\w+)?)
+        )
+      /xi
+
       # Returns every table/schema-qualified identifier referenced in the SQL
       # string. Noise (comments, string literals, dollar-quoted bodies) is
       # stripped before scanning. Both JOIN-style and ANSI-89 comma-join syntax
       # are handled.
       #
-      # Literals are stripped under BOTH supported dialects and the scans
-      # unioned. This scanner backs TableGate, so it may over-detect but must
-      # never under-detect: stripping with the wrong dialect's escape rules
-      # can swallow a real FROM clause — e.g. MySQL's `\'` escape applied on
-      # a PostgreSQL host (where backslash is literal under
-      # standard_conforming_strings) folds `'x\' FROM blocked WHERE y = '`
-      # into one literal, hiding `blocked` from the gate while PostgreSQL
-      # genuinely reads that table.
+      # A known adapter restricts the dialect, but not its session quote modes.
+      # Without known session settings, MySQL scans every quote-mode combination. An unknown
+      # adapter also scans PostgreSQL. This may over-detect, but must not hide a
+      # table merely because the server uses a different quote interpretation.
+      #
+      # MySQL executable comments (`/*! ... */`) are scanned under both of
+      # their possible semantics (see .executable_comment_views) so a table
+      # hidden at FROM/JOIN/subquery lead position is still surfaced.
       #
       # @param sql [String, nil] the SQL string to scan
       # @return [Array<String>] identifiers in first-encounter order, deduplicated
-      def self.identifiers_in(sql)
+      def self.identifiers_in(sql, dialect: nil, mysql_modes: nil)
         return [] if sql.nil? || sql.empty?
 
         results = []
-        %i[postgres mysql].each do |dialect|
-          stripped = strip_noise(sql, dialect: dialect)
-          collect_join_identifiers(stripped, results)
-          collect_from_identifiers(stripped, results)
+        (dialect ? [dialect] : %i[postgres mysql]).each do |dialect|
+          views = SqlNoiseStripper.security_views(sql, dialect: dialect, mysql_modes: mysql_modes)
+          views.flat_map { |stripped| executable_comment_views(stripped) }.each do |view|
+            collect_join_identifiers(view, results)
+            collect_from_identifiers(view, results)
+            collect_table_statement_identifiers(view, results)
+          end
         end
         results.uniq
       end
 
       # @api private
-      # Comments and literals must be stripped in a single combined pass —
-      # stripping them separately lets a comment marker inside a literal
-      # (`'-- '`) hide a real FROM clause from the gate. See
-      # {SqlNoiseStripper.strip_noise}.
-      def self.strip_noise(sql, dialect:)
-        SqlNoiseStripper.strip_noise(sql, dialect: dialect)
+      # Every view of the stripped SQL the FROM/JOIN scans must consider for
+      # MySQL executable comments (`/*! ... */`). {SqlNoiseStripper} leaves
+      # these forms in place because MySQL executes their body, but the lead
+      # grammars (FROM_CLAUSE/LEAD_IDENT/JOIN_REFERENCE) cannot start on a
+      # comment marker, so `SELECT * FROM /*!authorizations*/` surfaced no
+      # identifier and a blocked table slipped past TableGate. Each view
+      # interprets the form under one of its two possible semantics, mirroring
+      # SqlValidator#lock_clause_views: the whole construct replaced by its
+      # body (version guard satisfied — the body executes in place) and the
+      # whole construct dropped (guard unsatisfied — the form is inert
+      # whitespace). The stripped text itself is always scanned too: it keeps
+      # the preserved-form behavior the post-comma executable-comment shape
+      # relies on, and no comment body is ever hidden from the union.
+      #
+      # Over-detection on PostgreSQL (where the `/*!` form is a syntax error)
+      # is acceptable: the gate may reject more than a server would execute,
+      # never less.
+      def self.executable_comment_views(stripped)
+        [stripped,
+         stripped.gsub(EXECUTABLE_COMMENT_PATTERN) { Regexp.last_match[1] },
+         stripped.gsub(EXECUTABLE_COMMENT_PATTERN, ' ')]
       end
-      private_class_method :strip_noise
+      private_class_method :executable_comment_views
 
       # @api private
       def self.collect_join_identifiers(sql, results)
@@ -163,6 +213,16 @@ module Woods
       end
       private_class_method :collect_from_identifiers
 
+      # @api private
+      # Collect identifiers referenced by the standalone `TABLE name`
+      # statement (see {TABLE_STATEMENT}).
+      def self.collect_table_statement_identifiers(sql, results)
+        sql.scan(TABLE_STATEMENT) do
+          results << qualified_identifier(Regexp.last_match)
+        end
+      end
+      private_class_method :collect_table_statement_identifiers
+
       # @api private
       # Split a comma-separated list at depth 0, skipping commas inside parens.
       def self.split_top_level_commas(clause) # rubocop:disable Metrics/MethodLength