woods 1.6.4 → 2.0.0.beta1

data/lib/woods/console/sql_noise_stripper.rb

@@ -30,8 +30,8 @@ module Woods
       # newline-separated statement structure is preserved for callers that
       # check for multiple statements.
       #
-      # This legacy helper is not a security scanner. Use strip_noise for
-      # quote-aware and PostgreSQL nested-comment handling.
+      # Block comments are non-nested — real SQL engines do not support nested
+      # block comments, and neither does this stripper.
       #
       # @param sql [String] the SQL string to process
       # @return [String] a new string with all SQL comments removed
@@ -40,7 +40,7 @@ module Woods
 
       def self.strip_comments(sql)
         out = sql.gsub(LINE_COMMENT, '')
-        out.gsub(BLOCK_COMMENT, ' ')
+        out.gsub(BLOCK_COMMENT, '')
       end
 
       # Strips single-quoted string literals and (for the `:postgres` dialect)
@@ -53,21 +53,20 @@ module Woods
       # single-quote scanner.
       #
       # @param sql [String] the SQL string to process
-      # @param dialect [Symbol] `:postgres` (default), `:mysql`, or `:sqlite`.
+      # @param dialect [Symbol] `:postgres` (default) or `:mysql`.
       #   - `:postgres` — single-quoted strings support `''` as an apostrophe
       #     escape. Backslash is treated literally and does not escape quotes.
       #     Dollar-quoted strings (`$$...$$`, `$tag$...$tag$`) are also stripped.
       #   - `:mysql` — single-quoted strings support both `\'` (backslash-escape)
       #     and `''` (doubled-quote) as apostrophe escapes. Dollar-quoted strings
       #     are not recognized by the combined MySQL security scanner.
-      #   - `:sqlite` — doubled apostrophes escape strings; backslashes and dollar signs are literal.
       # @return [String] a new string with all string literals replaced by `''`
       # @raise [ArgumentError] if an unsupported dialect is provided
       DOLLAR_QUOTED = /\$(\w*)\$.*?\$\1\$/m
       SINGLE_QUOTED_POSTGRES = /'(?:''|[^'])*'/m
       SINGLE_QUOTED_MYSQL    = /'(?:\\.|''|[^'])*'/m
 
-      SUPPORTED_DIALECTS = %i[postgres mysql sqlite].freeze
+      SUPPORTED_DIALECTS = %i[postgres mysql].freeze
       private_constant :SUPPORTED_DIALECTS
 
       def self.strip_literals(sql, dialect: :postgres)
@@ -77,7 +76,7 @@ module Woods
 
         # Strip dollar-quoted strings first so stray apostrophes inside them
         # do not interfere with the single-quote scanner.
-        out = dialect == :sqlite ? sql : sql.gsub(DOLLAR_QUOTED, "''")
+        out = sql.gsub(DOLLAR_QUOTED, "''")
 
         pattern = dialect == :mysql ? SINGLE_QUOTED_MYSQL : SINGLE_QUOTED_POSTGRES
         out.gsub(pattern, "''")
@@ -101,10 +100,9 @@ module Woods
       # `:mysql` dialect — PostgreSQL does not treat `#` as a comment, and
       # collapsing it there would hide SQL that a real PostgreSQL server
       # still executes. A MySQL `/*! ... */` executable comment is left
-      # visible as one span, including MariaDB's `/*M! ... */` spelling:
-      # its body can execute, so it must stay visible to every downstream
-      # scan without changing literal state outside the span. Leaving it
-      # visible under `:postgres` too is over-detection at
+      # untouched (not treated as a comment at all, under either dialect):
+      # MySQL runs its body, so it must stay visible to every downstream
+      # scan; leaving it visible under `:postgres` too is over-detection at
       # worst, never under-detection, on a server where it really is inert.
       # An ordinary `/* ... */` block comment is replaced by a single
       # newline rather than vanishing outright, mirroring how a `--`/`#`
@@ -114,7 +112,7 @@ module Woods
       # still reads as following a boundary once comments are gone.
       #
       # @param sql [String] the SQL string to process
-      # @param dialect [Symbol] `:postgres` (default), `:mysql`, or `:sqlite` — controls
+      # @param dialect [Symbol] `:postgres` (default) or `:mysql` — controls
       #   single-quote escape rules (see {.strip_literals}) and whether `#`
       #   opens a line comment. MySQL quote flags reflect session sql_mode.
       # @return [String] a new string with comments removed and every string
@@ -136,8 +134,7 @@ module Woods
           if ch == "'"
             close = single_quote_end(
               sql, i,
-              backslash_escapes: (mysql && !no_backslash_escapes) ||
-                (dialect == :postgres && postgres_escape_string?(sql, i))
+              backslash_escapes: (mysql && !no_backslash_escapes) || (!mysql && postgres_escape_string?(sql, i))
             )
             if close
               out << "''"
@@ -161,7 +158,7 @@ module Woods
               out << ch
               i += 1
             end
-          elsif (mysql || dialect == :sqlite) && ch == '`'
+          elsif mysql && ch == '`'
             close = quoted_span_end(sql, i, quote: '`', backslash_escapes: false)
             if close
               # Backticks delimit identifiers. Preserve the token for table
@@ -173,7 +170,7 @@ module Woods
               out << ch
               i += 1
             end
-          elsif dialect == :postgres && ch == '$' && !preceded_by_word_char?(sql, i) && (tag = dollar_tag_at(sql, i))
+          elsif !mysql && ch == '$' && !preceded_by_word_char?(sql, i) && (tag = dollar_tag_at(sql, i))
             close = sql.index(tag, i + tag.length)
             if close
               out << "''"
@@ -185,22 +182,8 @@ module Woods
           elsif dash_comment?(sql, i, mysql: mysql) || (mysql && ch == '#')
             nl = sql.index("\n", i)
             i = nl || len
-          elsif sql[i, 3] == '/*!' || sql[i, 4] == '/*M!'
-            close = block_comment_end(sql, i, nested: dialect == :postgres)
-            if close
-              comment = sql[i...close]
-              yield comment if block_given?
-              # An executable comment is a lexical boundary even when its
-              # version guard makes its body inert. A quote in that body must
-              # never change the scanner's state outside the comment.
-              out << comment
-              i = close
-            else
-              out << ch
-              i += 1
-            end
-          elsif ch == '/' && sql[i + 1] == '*'
-            close = block_comment_end(sql, i, nested: dialect == :postgres)
+          elsif ch == '/' && sql[i + 1] == '*' && sql[i + 2] != '!'
+            close = sql.index('*/', i + 2)
             if close
               # Preserve a newline in place of the removed comment, mirroring
               # line comments (see class docs): callers that check for
@@ -208,7 +191,7 @@ module Woods
               # need a survivable marker showing a comment sat here, the
               # same way a `--`/`#` comment's own trailing newline does.
               out << "\n"
-              i = close
+              i = close + 2
             else
               # Unterminated block comment: never under-detect. Leave it in
               # place (over-detection is safe; the old regex also required a
@@ -225,20 +208,6 @@ module Woods
         out
       end
 
-      def self.block_comment_end(sql, start, nested:)
-        depth = 1
-        position = start + 2
-        while (match = %r{/\*|\*/}.match(sql, position))
-          depth += 1 if nested && match[0] == '/*'
-          depth -= 1 if match[0] == '*/'
-          return match.end(0) if depth.zero?
-
-          position = match.end(0)
-        end
-        nil
-      end
-      private_class_method :block_comment_end
-
       # Session modes change MySQL quoting without changing the adapter name.
       # Security consumers must reject SQL unsafe under any supported combination.
       MYSQL_QUOTE_MODES = [false, true].product([false, true]).map do |ansi, no_backslash|
@@ -260,7 +229,7 @@ module Woods
 
       # Regexp matching a PostgreSQL dollar-quote opening tag (`$$` or
       # `$tag$`) at the start of the given slice.
-      DOLLAR_TAG = /\A\$(?:[A-Za-z_\u0080-\u{10ffff}][A-Za-z0-9_\u0080-\u{10ffff}]*)?\$/u
+      DOLLAR_TAG = /\A\$\w*\$/
       private_constant :DOLLAR_TAG
 
       # Return the dollar-quote tag opening at +index+, or nil.
@@ -273,7 +242,7 @@ module Woods
       private_class_method :dollar_tag_at
 
       # Whether the character immediately before +index+ is a word character
-      # (including high-bit characters). PostgreSQL allows `$` inside identifiers (`x$a$`), so a `$`
+      # (`\w`). PostgreSQL allows `$` inside identifiers (`x$a$`), so a `$`
       # is only a candidate dollar-quote opener when it does NOT follow an
       # identifier character — otherwise `x$a$ FROM blocked, (SELECT 1 AS
       # z$a$)` gets misread as one dollar-quoted literal spanning the real
@@ -281,7 +250,7 @@ module Woods
       #
       # @api private
       def self.preceded_by_word_char?(sql, index)
-        index.positive? && sql[index - 1].match?(/[A-Za-z0-9_$\u0080-\u{10ffff}]/u)
+        index.positive? && sql[index - 1].match?(/\w/)
       end
       private_class_method :preceded_by_word_char?
 
@@ -332,7 +301,7 @@ module Woods
       def self.postgres_escape_string?(sql, quote_index)
         return false unless quote_index.positive? && sql[quote_index - 1].match?(/[eE]/)
 
-        quote_index < 2 || !sql[quote_index - 2].match?(/[A-Za-z0-9_$\u0080-\u{10ffff}]/u)
+        quote_index < 2 || !sql[quote_index - 2].match?(/[A-Za-z0-9_$]/)
       end
       private_class_method :postgres_escape_string?
     end # rubocop:enable Metrics/ModuleLength

data/lib/woods/console/sql_table_scanner.rb

@@ -38,20 +38,20 @@ module Woods
       # identifier so it does not hide the table name. ANSI-89 comma joins
       # are handled separately — see FROM_CLAUSE.
       JOIN_REFERENCE = /
-        \b(?:STRAIGHT_)?JOIN(?=[\s("`])\s*
-        (?:ONLY(?=[\s("`])\s*\(?\s*)?
+        \b(?:STRAIGHT_)?JOIN\s+
+        (?:ONLY\s+)?
         (?:
           (?:
-            `(?<jschema_bt>(?:``|[^`])+)` |
-            "(?<jschema_dq>(?:""|[^"])+)" |
-            (?<jschema_bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+)
+            `(?<jschema_bt>[^`]+)` |
+            "(?<jschema_dq>[^"]+)" |
+            (?<jschema_bare>\w+)
           )
           \s* \. \s*
         )?
         (?:
-          `(?<backtick>(?:``|[^`])+)` |
-          "(?<double>(?:""|[^"])+)"   |
-          (?<bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+(?:\.[A-Za-z0-9_$\u0080-\u{10ffff}]+)?)
+          `(?<backtick>[^`]+)` |
+          "(?<double>[^"]+)"   |
+          (?<bare>\w+(?:\.\w+)?)
         )
       /xi
 
@@ -66,7 +66,7 @@ module Woods
       # every `FROM` as its own independent scan match is what keeps CTEs,
       # UNIONs, and nested subqueries in coverage.
       FROM_CLAUSE = /
-        \bFROM(?=[\s("`])\s*
+        \bFROM\s+
         (?<clause>.+?)
         (?=
           \b(?:WHERE|GROUP|HAVING|ORDER|LIMIT|OFFSET|UNION|INTERSECT|EXCEPT|
@@ -85,16 +85,16 @@ module Woods
         \A
         (?:
           (?:
-            `(?<schema_bt>(?:``|[^`])+)` |
-            "(?<schema_dq>(?:""|[^"])+)" |
-            (?<schema_bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+)
+            `(?<schema_bt>[^`]+)` |
+            "(?<schema_dq>[^"]+)" |
+            (?<schema_bare>\w+)
           )
           \s* \. \s*
         )?
         (?:
-          `(?<backtick>(?:``|[^`])+)` |
-          "(?<double>(?:""|[^"])+)"   |
-          (?<bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+(?:\.[A-Za-z0-9_$\u0080-\u{10ffff}]+)?)
+          `(?<backtick>[^`]+)` |
+          "(?<double>[^"]+)"   |
+          (?<bare>\w+(?:\.\w+)?)
         )
       /xi
 
@@ -102,7 +102,7 @@ module Woods
       # identifier. Strip it so the lead-identifier regex sees the table
       # directly. Anchored with `\A` because callers strip leading whitespace
       # first via #strip.
-      ONLY_PREFIX = /\AONLY(?=[\s("`])\s*/i
+      ONLY_PREFIX = /\AONLY\s+/i
 
       # Matches a MySQL executable comment (`/*!...*/` or the version-guarded
       # `/*!NNNNN...*/`), capturing the body. Mirrors
@@ -110,7 +110,7 @@ module Woods
       # deliberately leaves these markers in place because their meaning is
       # version-dependent; .executable_comment_views scans both of their
       # possible semantics.
-      EXECUTABLE_COMMENT_PATTERN = %r{/\*(?:M)?!(?:\d{5,6})?(.*?)\*/}m
+      EXECUTABLE_COMMENT_PATTERN = %r{/\*!(?:\d{5})?(.*?)\*/}m
 
       # Matches the standalone SQL `TABLE name` statement (PostgreSQL, and
       # MySQL 8.0.19+) — shorthand for `SELECT * FROM name`. It appears as a
@@ -119,20 +119,20 @@ module Woods
       # scanned independently of FROM_CLAUSE/JOIN_REFERENCE rather than as
       # part of either. The identifier grammar mirrors LEAD_IDENT.
       TABLE_STATEMENT = /
-        \bTABLE(?=[\s("`])\s*
-        (?:ONLY(?=[\s("`])\s*\(?\s*)?
+        \bTABLE\s+
+        (?:ONLY\s+)?
         (?:
           (?:
-            `(?<schema_bt>(?:``|[^`])+)` |
-            "(?<schema_dq>(?:""|[^"])+)" |
-            (?<schema_bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+)
+            `(?<schema_bt>[^`]+)` |
+            "(?<schema_dq>[^"]+)" |
+            (?<schema_bare>\w+)
           )
           \s* \. \s*
         )?
         (?:
-          `(?<backtick>(?:``|[^`])+)` |
-          "(?<double>(?:""|[^"])+)"   |
-          (?<bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+(?:\.[A-Za-z0-9_$\u0080-\u{10ffff}]+)?)
+          `(?<backtick>[^`]+)` |
+          "(?<double>[^"]+)"   |
+          (?<bare>\w+(?:\.\w+)?)
         )
       /xi
 
@@ -167,51 +167,6 @@ module Woods
         results.uniq
       end
 
-      # Table-factor prefixes, retaining commas after balanced subqueries and
-      # JOIN predicates. Each nested FROM/JOIN is also scanned independently.
-      # SQL punctuation separates tokens without mandatory whitespace. Keep
-      # compact quoted targets and parenthesized relations in the same policy.
-      # @param sql [String] noise-stripped SQL
-      # @return [Array<String>]
-      def self.relation_factors(sql)
-        sql.to_enum(:scan, /\b(?:FROM|(?:STRAIGHT_)?JOIN)(?=[\s("`])\s*/i).flat_map do
-          suffix = sql[Regexp.last_match.end(0)..]
-          split_top_level_commas(relation_clause(suffix))
-        end
-      end
-
-      # Quoted tokens shield punctuation and clause words; a closing parenthesis
-      # at depth zero ends this query's clause, not a nested table expression.
-      def self.relation_clause(suffix)
-        depth = 0
-        tokens = /
-          "(?:[^"]|"")*"|`(?:[^`]|``)*`|''|[()]|
-          \b(?:WHERE|GROUP|HAVING|ORDER|LIMIT|OFFSET|UNION|INTERSECT|EXCEPT|WINDOW)\b
-        /ix
-        suffix.to_enum(:scan, tokens).each do
-          token = Regexp.last_match[0]
-          start = Regexp.last_match.begin(0)
-          finish = Regexp.last_match.end(0)
-          boundary = token == ')' || relation_keyword_boundary?(suffix[0...start], suffix[finish..], token)
-          return suffix[0...start] if depth.zero? && boundary
-
-          depth += 1 if token == '('
-          depth -= 1 if token == ')'
-        end
-        suffix
-      end
-      private_class_method :relation_clause
-
-      def self.relation_keyword_boundary?(prefix, rest, token)
-        return false unless token.match?(/\A[A-Za-z]/)
-        return false if prefix.strip.empty? || prefix.match?(/(?:,|\bAS)\s*\z/i) || rest.lstrip.start_with?(',')
-        return rest.match?(/\A\s+BY\b/i) if %w[GROUP ORDER].include?(token.upcase)
-        return rest.match?(/\A\s+[A-Za-z0-9_$\u0080-\u{10ffff}]+\s+AS\b/i) if token.casecmp?('WINDOW')
-
-        true
-      end
-      private_class_method :relation_keyword_boundary?
-
       # @api private
       # Every view of the stripped SQL the FROM/JOIN scans must consider for
       # MySQL executable comments (`/*! ... */`). {SqlNoiseStripper} leaves
@@ -248,9 +203,12 @@ module Woods
 
       # @api private
       def self.collect_from_identifiers(sql, results)
-        relation_factors(sql).each do |chunk|
-          ident = lead_identifier(chunk)
-          results << ident if ident
+        sql.scan(FROM_CLAUSE) do
+          clause = Regexp.last_match[:clause]
+          split_top_level_commas(clause).each do |chunk|
+            ident = lead_identifier(chunk)
+            results << ident if ident
+          end
         end
       end
       private_class_method :collect_from_identifiers
@@ -271,7 +229,7 @@ module Woods
         depth = 0
         buf = +''
         parts = []
-        clause.scan(/"(?:[^"]|"")*"|`(?:[^`]|``)*`|''|./m).each do |ch|
+        clause.each_char do |ch|
           case ch
           when '('
             depth += 1
@@ -301,9 +259,8 @@ module Woods
       # PostgreSQL `ONLY` inheritance keyword is stripped first so it does
       # not hide the table.
       def self.lead_identifier(chunk)
-        stripped = chunk.to_s.strip.sub(/\A(?:\(\s*)+/, '').sub(ONLY_PREFIX, '')
-        stripped = stripped.sub(/\A(?:\(\s*)+/, '')
-        return nil if stripped.empty? || stripped.match?(/\A(?:SELECT|WITH|TABLE)\b/i)
+        stripped = chunk.to_s.strip.sub(ONLY_PREFIX, '')
+        return nil if stripped.empty?
 
         match = LEAD_IDENT.match(stripped)
         return nil unless match
@@ -316,22 +273,14 @@ module Woods
       # Combine a schema prefix with the table identifier captured by
       # JOIN_REFERENCE / LEAD_IDENT into a single `schema.table` string.
       def self.qualified_identifier(match)
-        captures = match.named_captures
-        table = decoded_identifier(*captures.values_at('backtick', 'double', 'bare'))
-        schema = decoded_identifier(captures['schema_bt'] || captures['jschema_bt'],
-                                    captures['schema_dq'] || captures['jschema_dq'],
-                                    captures['schema_bare'] || captures['jschema_bare'])
+        table = match[:backtick] || match[:double] || match[:bare]
+        schema = match.named_captures.values_at(
+          'schema_bt', 'schema_dq', 'schema_bare',
+          'jschema_bt', 'jschema_dq', 'jschema_bare'
+        ).compact.first
         schema ? "#{schema}.#{table}" : table
       end
       private_class_method :qualified_identifier
-
-      def self.decoded_identifier(backtick, double, bare)
-        return backtick.gsub('``', '`') if backtick
-        return double.gsub('""', '"') if double
-
-        bare
-      end
-      private_class_method :decoded_identifier
     end
   end
 end