@memberjunction/global 6.2.0-edge.4 → 6.2.0-edge.5

package/dist/SQLScreeningScanner.d.ts

@@ -0,0 +1,91 @@
+/**
+ * @fileoverview Dialect-aware SQL scanner for MemberJunction's SQL denylist screens.
+ *
+ * A denylist screen is only as good as its idea of which text is code. This scanner reads SQL the
+ * way SQL Server or PostgreSQL splits it into tokens and marks every string literal, quoted
+ * identifier and comment, so a screen checks exactly the text the database runs as code. When it
+ * cannot read the text the way the database would, it reports that, so the screen rejects the text
+ * instead of guessing.
+ *
+ * Used by `SQLExpressionValidator` and `DatabaseProviderBase.ValidateUserProvidedSQLClause`.
+ *
+ * @module @memberjunction/global/SQLScreeningScanner
+ */
+/** SQL dialects whose lexical rules {@link ScanSQLForScreening} knows. */
+export type SQLScreeningDialect = 'sqlserver' | 'postgresql';
+/**
+ * Every dialect {@link ScanSQLForScreening} knows. A screen that does not know which database will
+ * run the SQL must accept it under each one.
+ */
+export declare const SQL_SCREENING_DIALECTS: readonly SQLScreeningDialect[];
+/** Kinds of text that the database never runs as code. */
+export type SQLScreeningSpanKind = 'string' | 'identifier' | 'comment';
+/** One string literal, quoted identifier or comment found by {@link ScanSQLForScreening}. */
+export interface SQLScreeningSpan {
+    Kind: SQLScreeningSpanKind;
+    /** Offset of the first character, including a prefix such as `N` or `E`. */
+    Start: number;
+    /** Offset just past the last character. */
+    End: number;
+}
+/** Result of {@link ScanSQLForScreening}. */
+export interface SQLScreeningScan {
+    /** The dialect whose rules were applied. */
+    Dialect: SQLScreeningDialect;
+    /** True when every character was read the way the database reads it. When false, reject the text. */
+    Classified: boolean;
+    /** Why the text could not be classified; null when {@link Classified} is true. */
+    Error: string | null;
+    /** The string literals, quoted identifiers and comments found, in order. */
+    Spans: SQLScreeningSpan[];
+    /** Number of comments found. */
+    CommentCount: number;
+    /**
+     * The input with each string literal, quoted identifier and comment replaced by one space, and a
+     * space between a number and a word written against it. Only code remains, split where the
+     * database splits it, so `N'x'UNION` reads as ` UNION` and `1UNION` as `1 UNION`. Keyword,
+     * statement-separator and comment-marker checks read this. When {@link Classified} is false,
+     * the text from the point where the scan stopped is left as written.
+     */
+    Code: string;
+    /**
+     * {@link Code}, except each quoted identifier is written as its bare name between spaces, so
+     * `[sys].[objects]` reads as ` sys . objects `. Checks for object and function names read this,
+     * so quoting a name does not hide it.
+     */
+    CodeWithIdentifiers: string;
+    /**
+     * The first token that is not whitespace or a comment, when that token is an unquoted word and
+     * the character after it is ASCII, so every server ends the word in the same place. Null when a
+     * literal, quoted identifier, number or symbol comes first, or there is no token. Checks for the
+     * statement's opening keyword read this.
+     */
+    LeadingWord: string | null;
+}
+/**
+ * Reads `sql` the way `dialect` splits it into tokens. Returns the string literals, quoted
+ * identifiers and comments it contains, and the code that remains.
+ *
+ * Both dialects: `'…'` and `N'…'` strings, in which `''` is an escaped quote and a backslash is an
+ * ordinary character; `"…"` identifiers with `""` escapes; `--` comments to the end of the line; and
+ * nested block comments. SQL Server adds `[…]` identifiers with `]]` escapes. PostgreSQL adds `E'…'`
+ * strings, in which a backslash escapes the next character, and dollar-quoted strings (`$$…$$`,
+ * `$tag$…$tag$`); a `[` is code there.
+ *
+ * 🚨 Do not add backslash escapes to plain `'…'` strings. Neither server honors them (PostgreSQL is
+ * assumed to run with `standard_conforming_strings = on`, its default since 9.1), and a scanner that
+ * does reads `x = 'a\') ; DROP TABLE t; --'` as one literal while the database runs the DROP.
+ *
+ * The scan stops and reports an error, instead of guessing, when:
+ * - a string, quoted identifier, dollar-quoted string or block comment is not closed;
+ * - the text contains a NUL character;
+ * - a `--` comment contains a line break other than `\n` or `\r\n`;
+ * - a PostgreSQL `E'…'` string is followed by another quoted segment, which PostgreSQL can join to
+ *   it and read with backslash escapes;
+ * - on SQL Server, a number is followed by `e` and a word character (`1EXEC` splits two ways).
+ *
+ * @param sql The clause, expression or query to read
+ * @param dialect The dialect whose lexical rules apply
+ */
+export declare function ScanSQLForScreening(sql: string, dialect: SQLScreeningDialect): SQLScreeningScan;
+//# sourceMappingURL=SQLScreeningScanner.d.ts.map

package/dist/SQLScreeningScanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SQLScreeningScanner.d.ts","sourceRoot":"","sources":["../src/SQLScreeningScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAAgC,CAAC;AAElG,0DAA0D;AAC1D,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;AAEvE,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC7B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;CACf;AAED,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC7B,4CAA4C;IAC5C,OAAO,EAAE,mBAAmB,CAAC;IAC7B,qGAAqG;IACrG,UAAU,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AA2DD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,gBAAgB,CAE/F"}

package/dist/SQLScreeningScanner.js

@@ -0,0 +1,332 @@
+/**
+ * @fileoverview Dialect-aware SQL scanner for MemberJunction's SQL denylist screens.
+ *
+ * A denylist screen is only as good as its idea of which text is code. This scanner reads SQL the
+ * way SQL Server or PostgreSQL splits it into tokens and marks every string literal, quoted
+ * identifier and comment, so a screen checks exactly the text the database runs as code. When it
+ * cannot read the text the way the database would, it reports that, so the screen rejects the text
+ * instead of guessing.
+ *
+ * Used by `SQLExpressionValidator` and `DatabaseProviderBase.ValidateUserProvidedSQLClause`.
+ *
+ * @module @memberjunction/global/SQLScreeningScanner
+ */
+/**
+ * Every dialect {@link ScanSQLForScreening} knows. A screen that does not know which database will
+ * run the SQL must accept it under each one.
+ */
+export const SQL_SCREENING_DIALECTS = ['sqlserver', 'postgresql'];
+const LEXICAL_RULES = {
+    sqlserver: {
+        BracketIdentifiers: true,
+        PostgresStrings: false,
+        // Letters and digits of any script. Other non-ASCII characters are not part of a word: SQL
+        // Server reads a currency symbol such as ¥ as the start of a money literal, so in `¥1SELECT`
+        // the keyword is a separate token.
+        WordStart: /[\p{L}_@#]/u,
+        WordPart: /[\p{L}\p{N}_@#$]/u,
+        BareExponent: true,
+    },
+    postgresql: {
+        BracketIdentifiers: false,
+        PostgresStrings: true,
+        WordStart: /[A-Za-z_\u0080-￿]/,
+        WordPart: /[A-Za-z0-9_$\u0080-￿]/,
+        BareExponent: false,
+    },
+};
+const DIGIT = /[0-9]/;
+const WHITESPACE = /\s/;
+/** Whitespace every server skips. Other Unicode spaces count as a token when finding the leading word. */
+const ASCII_WHITESPACE = /[ \t\n\r\f\v]/;
+const NON_ASCII = /[^\x00-\x7f]/;
+/**
+ * A numeric literal at `lastIndex` (sticky). An exponent needs digits, so in PostgreSQL's `1e'…'`
+ * the `e` is left to open an E'…' string.
+ */
+const NUMBER = /0[xX][0-9A-Fa-f]*|(?:[0-9]+(?:\.[0-9]*)?|\.[0-9]+)(?:[eE][+-]?[0-9]+)?/y;
+/** A PostgreSQL `$$` or `$tag$` delimiter at `lastIndex` (sticky). */
+const DOLLAR_DELIMITER = /\$(?:[A-Za-z_\u0080-￿][A-Za-z0-9_\u0080-￿]*)?\$/y;
+/** Line breaks other than `\n` and `\r\n`. Servers disagree on whether they end a `--` comment. */
+const AMBIGUOUS_LINE_BREAKS = new Set(['\r', '\u000b', '\u000c', '\u0085', '
', '
']);
+/**
+ * Reads `sql` the way `dialect` splits it into tokens. Returns the string literals, quoted
+ * identifiers and comments it contains, and the code that remains.
+ *
+ * Both dialects: `'…'` and `N'…'` strings, in which `''` is an escaped quote and a backslash is an
+ * ordinary character; `"…"` identifiers with `""` escapes; `--` comments to the end of the line; and
+ * nested block comments. SQL Server adds `[…]` identifiers with `]]` escapes. PostgreSQL adds `E'…'`
+ * strings, in which a backslash escapes the next character, and dollar-quoted strings (`$$…$$`,
+ * `$tag$…$tag$`); a `[` is code there.
+ *
+ * 🚨 Do not add backslash escapes to plain `'…'` strings. Neither server honors them (PostgreSQL is
+ * assumed to run with `standard_conforming_strings = on`, its default since 9.1), and a scanner that
+ * does reads `x = 'a\') ; DROP TABLE t; --'` as one literal while the database runs the DROP.
+ *
+ * The scan stops and reports an error, instead of guessing, when:
+ * - a string, quoted identifier, dollar-quoted string or block comment is not closed;
+ * - the text contains a NUL character;
+ * - a `--` comment contains a line break other than `\n` or `\r\n`;
+ * - a PostgreSQL `E'…'` string is followed by another quoted segment, which PostgreSQL can join to
+ *   it and read with backslash escapes;
+ * - on SQL Server, a number is followed by `e` and a word character (`1EXEC` splits two ways).
+ *
+ * @param sql The clause, expression or query to read
+ * @param dialect The dialect whose lexical rules apply
+ */
+export function ScanSQLForScreening(sql, dialect) {
+    return new SQLScreeningScanner(sql, dialect).Scan();
+}
+/** One left-to-right pass over the input, with the dialect's rules. */
+class SQLScreeningScanner {
+    constructor(sql, dialect) {
+        this.sql = sql;
+        this.dialect = dialect;
+        this.spans = [];
+        this.code = [];
+        this.codeWithIdentifiers = [];
+        this.commentCount = 0;
+        this.pos = 0;
+        /** Offset of the first token that is not whitespace or a comment, once one is reached. */
+        this.leadingTokenStart = null;
+        this.leadingWord = null;
+        this.rules = LEXICAL_RULES[dialect];
+    }
+    Scan() {
+        if (!SQL_SCREENING_DIALECTS.includes(this.dialect))
+            return this.stop(`"${this.dialect}" is not a known SQL dialect`);
+        if (this.sql.includes('\0'))
+            return this.stop('the text contains a NUL character');
+        while (this.pos < this.sql.length) {
+            const error = this.readToken();
+            if (error !== null)
+                return this.stop(error);
+        }
+        return this.result(null);
+    }
+    /** Reads the token at `pos`. Returns why the text cannot be classified, or null. */
+    readToken() {
+        const c = this.sql[this.pos];
+        const next = this.sql[this.pos + 1] ?? '';
+        if (c === '-' && next === '-')
+            return this.readLineComment();
+        if (c === '/' && next === '*')
+            return this.readBlockComment();
+        if (this.leadingTokenStart === null && !ASCII_WHITESPACE.test(c))
+            this.leadingTokenStart = this.pos;
+        if (c === "'")
+            return this.readString(this.pos + 1);
+        if ((c === 'N' || c === 'n') && next === "'")
+            return this.readString(this.pos + 2);
+        if (this.rules.PostgresStrings && (c === 'E' || c === 'e') && next === "'")
+            return this.readEscapeString();
+        if (this.rules.PostgresStrings && c === '$') {
+            const delimiter = this.dollarDelimiterAt(this.pos);
+            if (delimiter !== null)
+                return this.readDollarString(delimiter);
+        }
+        if (c === '"')
+            return this.readQuotedIdentifier('"');
+        if (this.rules.BracketIdentifiers && c === '[')
+            return this.readQuotedIdentifier(']');
+        if (DIGIT.test(c) || (c === '.' && DIGIT.test(next)))
+            return this.readNumber();
+        if (this.rules.WordStart.test(c))
+            return this.readWord();
+        this.emitCode(this.pos + 1);
+        return null;
+    }
+    /** Reads a `'…'` string whose content starts at `contentStart`. */
+    readString(contentStart) {
+        const end = this.findQuoteEnd(contentStart, "'", false);
+        if (end === -1)
+            return 'a string literal is not closed';
+        this.emitSpan('string', end);
+        return null;
+    }
+    /** Reads a PostgreSQL `E'…'` string, in which a backslash escapes the next character. */
+    readEscapeString() {
+        const end = this.findQuoteEnd(this.pos + 2, "'", true);
+        if (end === -1)
+            return "an E'…' string is not closed";
+        if (this.quoteFollows(end)) {
+            return "an E'…' string is followed by another quoted segment, which PostgreSQL can read as part of it";
+        }
+        this.emitSpan('string', end);
+        return null;
+    }
+    /** Reads a PostgreSQL dollar-quoted string that opens with `delimiter`. */
+    readDollarString(delimiter) {
+        const close = this.sql.indexOf(delimiter, this.pos + delimiter.length);
+        if (close === -1)
+            return 'a dollar-quoted string is not closed';
+        this.emitSpan('string', close + delimiter.length);
+        return null;
+    }
+    /** Reads a `"…"` or `[…]` identifier; `close` is its closing character. */
+    readQuotedIdentifier(close) {
+        const end = this.findQuoteEnd(this.pos + 1, close, false);
+        if (end === -1)
+            return 'a quoted identifier is not closed';
+        const name = this.sql.slice(this.pos + 1, end - 1).split(close + close).join(close);
+        this.emitSpan('identifier', end, name);
+        return null;
+    }
+    /** Reads a `--` comment, which ends at the end of the line. */
+    readLineComment() {
+        let j = this.pos + 2;
+        while (j < this.sql.length && this.sql[j] !== '\n') {
+            if (this.sql[j] === '\r' && this.sql[j + 1] === '\n')
+                break;
+            if (AMBIGUOUS_LINE_BREAKS.has(this.sql[j])) {
+                return 'a -- comment contains a line break that database servers read differently';
+            }
+            j++;
+        }
+        this.commentCount++;
+        this.emitSpan('comment', j);
+        return null;
+    }
+    /** Reads a block comment. Block comments nest on both SQL Server and PostgreSQL. */
+    readBlockComment() {
+        let depth = 0;
+        let j = this.pos;
+        while (j < this.sql.length) {
+            if (this.sql[j] === '/' && this.sql[j + 1] === '*') {
+                depth++;
+                j += 2;
+            }
+            else if (this.sql[j] === '*' && this.sql[j + 1] === '/') {
+                depth--;
+                j += 2;
+                if (depth === 0) {
+                    this.commentCount++;
+                    this.emitSpan('comment', j);
+                    return null;
+                }
+            }
+            else {
+                j++;
+            }
+        }
+        return 'a block comment is not closed';
+    }
+    /** Reads a number. A word written against it is a separate token, so a space is added between. */
+    readNumber() {
+        NUMBER.lastIndex = this.pos;
+        const match = NUMBER.exec(this.sql);
+        const end = this.pos + (match ? match[0].length : 1);
+        const following = this.sql[end] ?? '';
+        const afterThat = this.sql[end + 1] ?? '';
+        if (this.rules.BareExponent && (following === 'e' || following === 'E') && this.rules.WordStart.test(afterThat)) {
+            return 'a number is followed by a word that starts with E, which the server can read as part of the number';
+        }
+        this.emitCode(end);
+        if (following !== '' && this.rules.WordStart.test(following))
+            this.emitBoundary();
+        return null;
+    }
+    /** Reads an unquoted keyword or identifier. */
+    readWord() {
+        let j = this.pos + 1;
+        while (j < this.sql.length && this.rules.WordPart.test(this.sql[j]))
+            j++;
+        if (this.pos === this.leadingTokenStart && !NON_ASCII.test(this.sql[j] ?? '')) {
+            this.leadingWord = this.sql.slice(this.pos, j);
+        }
+        this.emitCode(j);
+        return null;
+    }
+    /**
+     * Offset just past the `close` character that ends a quoted run whose content starts at `from`,
+     * or -1 when none does. A doubled `close` is an escaped one; with `backslashEscapes`, so is any
+     * character after a backslash.
+     */
+    findQuoteEnd(from, close, backslashEscapes) {
+        let j = from;
+        while (j < this.sql.length) {
+            const ch = this.sql[j];
+            if (backslashEscapes && ch === '\\') {
+                j += 2;
+            }
+            else if (ch !== close) {
+                j++;
+            }
+            else if (this.sql[j + 1] === close) {
+                j += 2;
+            }
+            else {
+                return j + 1;
+            }
+        }
+        return -1;
+    }
+    /** Whether only whitespace and `--` comments come between `from` and the next `'`. */
+    quoteFollows(from) {
+        let j = from;
+        while (j < this.sql.length) {
+            const ch = this.sql[j];
+            if (ch === "'")
+                return true;
+            if (ch === '-' && this.sql[j + 1] === '-') {
+                j = this.lineEnd(j);
+            }
+            else if (WHITESPACE.test(ch)) {
+                j++;
+            }
+            else {
+                return false;
+            }
+        }
+        return false;
+    }
+    /** Offset of the first `\n` or `\r` at or after `from`, or the input length. */
+    lineEnd(from) {
+        let j = from;
+        while (j < this.sql.length && this.sql[j] !== '\n' && this.sql[j] !== '\r')
+            j++;
+        return j;
+    }
+    /** The `$$` or `$tag$` delimiter at `at`, or null when the `$` does not open a dollar-quoted string. */
+    dollarDelimiterAt(at) {
+        DOLLAR_DELIMITER.lastIndex = at;
+        return DOLLAR_DELIMITER.exec(this.sql)?.[0] ?? null;
+    }
+    /** Copies code up to `end` into both projections. */
+    emitCode(end) {
+        const text = this.sql.slice(this.pos, end);
+        this.code.push(text);
+        this.codeWithIdentifiers.push(text);
+        this.pos = end;
+    }
+    /** Records a span up to `end` and writes a space for it, or an identifier's bare name. */
+    emitSpan(kind, end, identifierName) {
+        this.spans.push({ Kind: kind, Start: this.pos, End: end });
+        this.code.push(' ');
+        this.codeWithIdentifiers.push(identifierName === undefined ? ' ' : ` ${identifierName} `);
+        this.pos = end;
+    }
+    /** Writes a token boundary that the input leaves implicit. */
+    emitBoundary() {
+        this.code.push(' ');
+        this.codeWithIdentifiers.push(' ');
+    }
+    /** Ends the scan at `pos`, leaving the unread text as written. */
+    stop(error) {
+        this.emitCode(this.sql.length);
+        return this.result(error);
+    }
+    result(error) {
+        return {
+            Dialect: this.dialect,
+            Classified: error === null,
+            Error: error,
+            Spans: this.spans,
+            CommentCount: this.commentCount,
+            Code: this.code.join(''),
+            CodeWithIdentifiers: this.codeWithIdentifiers.join(''),
+            LeadingWord: this.leadingWord,
+        };
+    }
+}
+//# sourceMappingURL=SQLScreeningScanner.js.map

package/dist/SQLScreeningScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SQLScreeningScanner.js","sourceRoot":"","sources":["../src/SQLScreeningScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAkElG,MAAM,aAAa,GAA8C;IAC7D,SAAS,EAAE;QACP,kBAAkB,EAAE,IAAI;QACxB,eAAe,EAAE,KAAK;QACtB,2FAA2F;QAC3F,6FAA6F;QAC7F,mCAAmC;QACnC,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,mBAAmB;QAC7B,YAAY,EAAE,IAAI;KACrB;IACD,UAAU,EAAE;QACR,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,mBAAmB;QAC9B,QAAQ,EAAE,uBAAuB;QACjC,YAAY,EAAE,KAAK;KACtB;CACJ,CAAC;AAEF,MAAM,KAAK,GAAG,OAAO,CAAC;AACtB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,0GAA0G;AAC1G,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,SAAS,GAAG,cAAc,CAAC;AAEjC;;;GAGG;AACH,MAAM,MAAM,GAAG,yEAAyE,CAAC;AAEzF,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,kDAAkD,CAAC;AAE5E,mGAAmG;AACnG,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;CAC/F,EAAE;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAA4B;IACzE,OAAO,IAAI,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,mBAAmB;IAWrB,YACqB,GAAW,EACX,OAA4B;QAD5B,QAAG,GAAH,GAAG,CAAQ;QACX,YAAO,GAAP,OAAO,CAAqB;QAXhC,UAAK,GAAuB,EAAE,CAAC;QAC/B,SAAI,GAAa,EAAE,CAAC;QACpB,wBAAmB,GAAa,EAAE,CAAC;QAC5C,iBAAY,GAAG,CAAC,CAAC;QACjB,QAAG,GAAG,CAAC,CAAC;QAChB,0FAA0F;QAClF,sBAAiB,GAAkB,IAAI,CAAC;QACxC,gBAAW,GAAkB,IAAI,CAAC;QAMtC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAEM,IAAI;QACP,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,8BAA8B,CAAC,CAAC;QACrH,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,oFAAoF;IAC5E,SAAS;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC;QACpG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3G,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/E,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,mEAAmE;IAC3D,UAAU,CAAC,YAAoB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,gCAAgC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,yFAAyF;IACjF,gBAAgB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,8BAA8B,CAAC;QACtD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,+FAA+F,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,2EAA2E;IACnE,gBAAgB,CAAC,SAAiB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,sCAAsC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,2EAA2E;IACnE,oBAAoB,CAAC,KAAgB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,mCAAmC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,+DAA+D;IACvD,eAAe;QACnB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,MAAM;YAC5D,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,OAAO,2EAA2E,CAAC;YACvF,CAAC;YACD,CAAC,EAAE,CAAC;QACR,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,oFAAoF;IAC5E,gBAAgB;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;QACjB,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACjD,KAAK,EAAE,CAAC;gBACR,CAAC,IAAI,CAAC,CAAC;YACX,CAAC;iBAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxD,KAAK,EAAE,CAAC;gBACR,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBACd,IAAI,CAAC,YAAY,EAAE,CAAC;oBACpB,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;oBAC5B,OAAO,IAAI,CAAC;gBAChB,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,CAAC,EAAE,CAAC;YACR,CAAC;QACL,CAAC;QACD,OAAO,+BAA+B,CAAC;IAC3C,CAAC;IAED,kGAAkG;IAC1F,UAAU;QACd,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9G,OAAO,oGAAoG,CAAC;QAChH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,+CAA+C;IACvC,QAAQ;QACZ,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,IAAY,EAAE,KAAa,EAAE,gBAAyB;QACvE,IAAI,CAAC,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,gBAAgB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAClC,CAAC,IAAI,CAAC,CAAC;YACX,CAAC;iBAAM,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACtB,CAAC,EAAE,CAAC;YACR,CAAC;iBAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBACnC,CAAC,IAAI,CAAC,CAAC;YACX,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;IACd,CAAC;IAED,sFAAsF;IAC9E,YAAY,CAAC,IAAY;QAC7B,IAAI,CAAC,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC5B,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;iBAAM,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7B,CAAC,EAAE,CAAC;YACR,CAAC;iBAAM,CAAC;gBACJ,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,gFAAgF;IACxE,OAAO,CAAC,IAAY;QACxB,IAAI,CAAC,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,CAAC,EAAE,CAAC;QAChF,OAAO,CAAC,CAAC;IACb,CAAC;IAED,wGAAwG;IAChG,iBAAiB,CAAC,EAAU;QAChC,gBAAgB,CAAC,SAAS,GAAG,EAAE,CAAC;QAChC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACxD,CAAC;IAED,qDAAqD;IAC7C,QAAQ,CAAC,GAAW;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACnB,CAAC;IAED,0FAA0F;IAClF,QAAQ,CAAC,IAA0B,EAAE,GAAW,EAAE,cAAuB;QAC7E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC;QAC1F,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACnB,CAAC;IAED,8DAA8D;IACtD,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,kEAAkE;IAC1D,IAAI,CAAC,KAAa;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAEO,MAAM,CAAC,KAAoB;QAC/B,OAAO;YACH,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,KAAK,KAAK,IAAI;YAC1B,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,WAAW;SAChC,CAAC;IACN,CAAC;CACJ"}

package/dist/__tests__/SQLExpressionValidator.security.test.js

@@ -214,7 +214,8 @@ describe('SQLExpressionValidator - Security', () => {
      */
     describe('literal stripper must match database parsing (backslash is NOT an escape)', () => {
         it('strips a doubled-quote literal exactly, leaving injected code visible', () => {
-            expect(StripSQLStringLiterals(`Name = 'O''Brien'`)).toBe('Name = ');
+            // The literal becomes one space, which keeps the token boundary the database sees.
+            expect(StripSQLStringLiterals(`Name = 'O''Brien'`)).toBe('Name =  ');
             expect(StripSQLStringLiterals(`x = 'a\\') ; DROP TABLE Users; --'`)).toContain('DROP TABLE Users');
         });
         it('leaves an UNTERMINATED literal in place rather than swallowing the rest', () => {
@@ -237,7 +238,9 @@ describe('SQLExpressionValidator - Security', () => {
                 entityFields: ['A'],
             });
             expect(r.valid).toBe(false);
-            expect(r.trigger).toBe('DROP');
+            // The literal closes at the second quote, so the trailing quote never closes and the text
+            // is rejected before any keyword check.
+            expect(r.trigger).toBe('unclassified');
         });
         it('blocks a backslash-hidden WAITFOR in an aggregate expression', () => {
             const r = validator.validate(`SUM(A)+'\\'; WAITFOR DELAY '0:0:5'; SELECT 1+'`, {
@@ -261,6 +264,177 @@ describe('SQLExpressionValidator - Security', () => {
             expect(r.valid).toBe(true);
         });
     });
+    /**
+     * 🚨 A quote is only a literal delimiter where the database says it is. Inside a T-SQL `[…]`
+     * identifier, a comment, or a PostgreSQL `$$…$$` string it is plain text; inside a PostgreSQL
+     * `E'…'` string a backslash escapes it. A stripper that misses any of these opens a literal the
+     * database never sees and hides the statement behind it. The payloads below run a harmless
+     * second statement (`SELECT 1`) on the database they target.
+     */
+    describe('literal stripper must agree with the database on identifiers, dialect strings and comments', () => {
+        const BRACKET_HIDDEN_STATEMENT = "Name = [a'] ; SELECT 1 ; SELECT [b']";
+        it('rejects a stacked statement hidden behind a bracket identifier containing a quote (where_clause)', () => {
+            const r = validator.validate(BRACKET_HIDDEN_STATEMENT, { context: 'where_clause' });
+            expect(r.valid).toBe(false);
+        });
+        it('rejects a stacked statement hidden behind bracket identifiers in an aggregate', () => {
+            const r = validator.validate("COUNT(*) AS [a'] ; SELECT 1 ; SELECT COUNT(*) AS [b'], COUNT(*)", {
+                context: 'aggregate',
+            });
+            expect(r.valid).toBe(false);
+        });
+        it('rejects a stacked statement hidden behind bracket identifiers in a full query', () => {
+            const r = validator.ValidateFullQuery("SELECT [a'] FROM T ; SELECT 1 ; SELECT [b'] FROM T");
+            expect(r.valid).toBe(false);
+        });
+        it('rejects a stacked statement hidden behind a PostgreSQL E-string escaped quote', () => {
+            const r = validator.validate("Name = E'\\'' ; SELECT 1 ; --'", { context: 'where_clause' });
+            expect(r.valid).toBe(false);
+        });
+        it('rejects a stacked statement hidden behind a PostgreSQL dollar-quoted string', () => {
+            const r = validator.validate("Name = $$'$$ ; SELECT 1 ; --'", { context: 'where_clause' });
+            expect(r.valid).toBe(false);
+        });
+        it('rejects a stacked statement hidden behind an E string written against an operator (PostgreSQL full query)', () => {
+            // `@@` is an operator, so PostgreSQL reads E'\'' as a one-character literal and runs SELECT 2.
+            const r = validator.ValidateFullQuery("SELECT 'a' @@E'\\'' ; SELECT 2 ; --'", 'postgresql');
+            expect(r.valid).toBe(false);
+        });
+        it('rejects a stacked statement hidden behind an apostrophe in a line comment (full query)', () => {
+            const r = validator.ValidateFullQuery("SELECT 1 -- it's\n; SELECT 2 --'");
+            expect(r.valid).toBe(false);
+        });
+        it('rejects a stacked statement hidden behind an apostrophe in a block comment (full query)', () => {
+            const r = validator.ValidateFullQuery("SELECT 1 /* it's */ ; SELECT 2 ; /* ' */");
+            expect(r.valid).toBe(false);
+        });
+        it('keeps a keyword that directly follows a literal visible', () => {
+            // SQL Server ends N'x' at the quote, so SELECT starts a new statement.
+            const r = validator.validate("Name = N'x'SELECT 1", { context: 'where_clause' });
+            expect(r.valid).toBe(false);
+            expect(r.trigger).toBe('SELECT');
+        });
+        it('StripSQLStringLiterals leaves the statement behind a bracket identifier visible', () => {
+            expect(StripSQLStringLiterals(BRACKET_HIDDEN_STATEMENT)).toContain('SELECT 1');
+        });
+        it('keeps a keyword that directly follows a number visible', () => {
+            const r = validator.validate('ID = 1SELECT 1', { context: 'where_clause' });
+            expect(r.valid).toBe(false);
+            expect(r.trigger).toBe('SELECT');
+        });
+    });
+    /**
+     * SQL Server runs the first statement of a batch as a procedure call without EXEC, and a quoted
+     * name is valid there. So a full query must open with the SELECT or WITH keyword itself, read as
+     * a token: not a quoted name, a literal or a longer word that starts with those letters.
+     */
+    describe('a full query must open with the SELECT or WITH keyword', () => {
+        const DIALECT_SETTINGS = [
+            ['sqlserver', 'sqlserver'],
+            ['postgresql', 'postgresql'],
+            ['no dialect', undefined],
+        ];
+        const OPENERS = [
+            "[sp_executesql] N'SELECT 2' SELECT 1",
+            '[sp_who] SELECT 1',
+            `"sp_executesql" N'SELECT 2' SELECT 1`,
+            '"sp_who" SELECT 1',
+            "N'x' SELECT 1",
+            '1 SELECT 1',
+            'WithdrawFunds 1',
+            'SelectiveDelete 5',
+        ];
+        for (const [label, dialect] of DIALECT_SETTINGS) {
+            it.each(OPENERS)(`refuses %s (${label})`, sql => {
+                const r = validator.ValidateFullQuery(sql, dialect);
+                expect(r.valid).toBe(false);
+            });
+        }
+        it.each([
+            'select Name from __mj.vwUsers',
+            '-- header\n/* block */\nWITH cte AS (SELECT 1 AS One) SELECT One FROM cte',
+        ])('accepts %s', sql => {
+            expect(validator.ValidateFullQuery(sql, 'sqlserver').valid).toBe(true);
+            expect(validator.ValidateFullQuery(sql, 'postgresql').valid).toBe(true);
+        });
+        const CASE_MAPPED_OPENERS = [
+            ['SELECT', '\u017Felect 1'],
+            ['WITH', 'w\u0131th x AS (SELECT 1 AS One) SELECT One FROM x'],
+        ];
+        for (const [label, dialect] of DIALECT_SETTINGS) {
+            it.each(CASE_MAPPED_OPENERS)(`refuses an opening word that matches %s only under Unicode case mapping (${label})`, (_keyword, sql) => {
+                const r = validator.ValidateFullQuery(sql, dialect);
+                expect(r.valid).toBe(false);
+                expect(r.error).toBe('Ad-hoc query must start with SELECT or WITH');
+            });
+        }
+        it('accepts SELECT and WITH in any ASCII case', () => {
+            for (const sql of ['SeLeCt 1 AS One', 'wItH cte AS (SELECT 1 AS One) SELECT One FROM cte']) {
+                expect(validator.ValidateFullQuery(sql, 'sqlserver').valid).toBe(true);
+                expect(validator.ValidateFullQuery(sql, 'postgresql').valid).toBe(true);
+            }
+        });
+    });
+    /**
+     * SQL Server reads a currency symbol such as ¥, £ or € as the start of a money literal, so the
+     * keyword written directly after the amount is a separate token.
+     */
+    describe('a keyword written against a currency-prefixed number', () => {
+        it.each(['sqlserver', undefined])('stays visible in a where clause (%s)', dialect => {
+            const r = validator.validate('ID = ¥1SELECT 1', { context: 'where_clause', Dialect: dialect });
+            expect(r.valid).toBe(false);
+            expect(validator.validate('ID = £1EXEC sp_who', { context: 'where_clause', Dialect: dialect }).valid).toBe(false);
+        });
+        it.each(['sqlserver', undefined])('stays visible in a full query (%s)', dialect => {
+            expect(validator.ValidateFullQuery('SELECT £1EXEC sp_who', dialect).valid).toBe(false);
+            expect(validator.ValidateFullQuery("SELECT €1WAITFOR DELAY '00:00:01'", dialect).valid).toBe(false);
+        });
+    });
+    describe('dialect-aware reading', () => {
+        const POSSESSIVE_ALIAS = "SELECT COUNT(*) AS [Today's Count] FROM __mj.vwUsers WHERE Status = 'Active'";
+        it('accepts a bracket identifier that contains a quote when the dialect is SQL Server', () => {
+            expect(validator.ValidateFullQuery(POSSESSIVE_ALIAS, 'sqlserver').valid).toBe(true);
+        });
+        it('rejects it when the dialect is unknown, because PostgreSQL reads the quote as a literal', () => {
+            const r = validator.ValidateFullQuery(POSSESSIVE_ALIAS);
+            expect(r.valid).toBe(false);
+            expect(r.trigger).toBe('unclassified');
+        });
+        it('accepts E strings and dollar-quoted strings when the dialect is PostgreSQL', () => {
+            const ctx = { context: 'where_clause', Dialect: 'postgresql' };
+            expect(validator.validate("Name = E'it\\'s'", ctx).valid).toBe(true);
+            expect(validator.validate("Name = $$it's$$", ctx).valid).toBe(true);
+        });
+        it('does not read keywords inside quoted identifiers', () => {
+            expect(validator.validate('[Delete Flag] = 1', { context: 'where_clause', Dialect: 'sqlserver' }).valid).toBe(true);
+            expect(validator.validate('"Update" = 1', { context: 'where_clause' }).valid).toBe(true);
+        });
+        it('accepts an apostrophe in the header comment of a full query', () => {
+            const r = validator.ValidateFullQuery("-- Customer's open orders\nSELECT * FROM __mj.vwOrders WHERE Status = 'Open'");
+            expect(r.valid).toBe(true);
+        });
+        it('accepts a trailing semicolon followed by a comment in a full query', () => {
+            expect(validator.ValidateFullQuery('SELECT Name FROM __mj.vwUsers ORDER BY Name; -- by name').valid).toBe(true);
+        });
+        it.each([
+            'SELECT * FROM [INFORMATION_SCHEMA].[TABLES]',
+            'SELECT name FROM [sys].[sql_logins]',
+            'SELECT * FROM "pg_catalog"."pg_authid"',
+        ])('catches a system catalog written with quoted names: %s', sql => {
+            const r = validator.ValidateFullQuery(sql);
+            expect(r.valid).toBe(false);
+            expect(r.trigger).toBe('system-object');
+        });
+        it('checks a quoted function name against the allowlist', () => {
+            const r = validator.validate('[dbo].[fnSecret](1) = 1', { context: 'where_clause', Dialect: 'sqlserver' });
+            expect(r.valid).toBe(false);
+            expect(r.trigger).toBe('FNSECRET');
+        });
+        it('StripSQLStringLiterals reads the given dialect, and removes nothing when the dialects disagree', () => {
+            expect(StripSQLStringLiterals("x = E'\\'' ; SELECT 1", 'postgresql')).toBe('x =   ; SELECT 1');
+            expect(StripSQLStringLiterals("x = E'\\'' ; SELECT 1")).toBe("x = E'\\'' ; SELECT 1");
+        });
+    });
     // ---------------------------------------------------------------
     // Expression-level injection (where_clause context)
     // ---------------------------------------------------------------