LucaCappelletti94 opened a new issue, #2840: URL: https://github.com/apache/datafusion-sqlparser-rs/issues/2840
Severity uses the [CVSS words](https://en.wikipedia.org/wiki/Common_Vulnerability_Scoring_System), `Critical` for silently dropped input, `High` for a different result, `Medium` for rejected valid SQL or unparseable output, `Low` for deep nesting or rare operator mixes, and `None` for a different tree with the same result. | Class | Dialect | SQL | sqlparser reads | engine reads | Severity | Status | |---|---|---|---|---|---|---| | C1 | all | `SELECT 1 END; SELECT 2` | `SELECT 1`, the rest is dropped without an error | `SELECT 1 AS "end"; SELECT 2` | Critical | #2838 | | C2 | PostgreSQL | `-2 ^ 2` | `-(2 ^ 2)` | `(-2) ^ 2` | High | #2819, #2829 | | C3 | PostgreSQL | `\|/ a + 3` | `(\|/ a) + 3` | `\|/ (a + 3)` | High | #814 | | C4 | PostgreSQL | `x = 'a' ~ 'b'` | `(x = 'a') ~ 'b'` | `x = ('a' ~ 'b')` | High | open | | C5 | PostgreSQL | `a>=-1` | custom operator `>=-` applied to `1` | `a >= (-1)` | High | open | | C6 | PostgreSQL, SQLite | `a ISNULL` | `a AS ISNULL` | `a IS NULL` | High | #2786 | | C7 | SQLite | `~ a * 2` | `~ (a * 2)` | `(~ a) * 2` | High | open | | C8 | SQLite | `a * 2 \|\| 'x'` | `(a * 2) \|\| 'x'` | `a * (2 \|\| 'x')` | High | open | | C9 | SQLite | `b ->> '$.n' + 1` | `b ->> ('$.n' + 1)` | `(b ->> '$.n') + 1` | High | open | | C10 | PostgreSQL | `OPERATOR(pg_catalog.-) 1 + 2` | rejected | `OPERATOR(pg_catalog.-) (1 + 2)` | Medium | open | | C11 | PostgreSQL | `1::textor(NOT NOT 1)` | prints `textor(NOT, NOT, 1)`, which PostgreSQL rejects | modifier is the expression `NOT (NOT 1)` | Medium | open | | C12 | PostgreSQL | `a BETWEEN SYMMETRIC 1 AND 2` | rejected | `BETWEEN SYMMETRIC` | Medium | #2522 | | C13 | SQLite | `a NOT NULL COLLATE BINARY = 1` | rejected | `((a NOT NULL) COLLATE BINARY) = 1` | Medium | open | | C14 | SQLite | `b NOT GLOB 'x*'` | rejected | `NOT (b GLOB 'x*')` | Medium | open | | C15 | PostgreSQL | `a OPERATOR(pg_catalog.+) 1 ?\| b` | `a OPERATOR(pg_catalog.+) (1 ?\| b)` | `(a OPERATOR(pg_catalog.+) 1) ?\| b` | Low | open | | C16 | PostgreSQL | `$1IS NULL` | placeholder `$1IS` | error `trailing junk after parameter` | Low | open | | C17 | all | `a = ANY(SELECT 1) + 1` | `a = ANY((SELECT 1) + 1)` | `(a = ANY(SELECT 1)) + 1` | Low | #2802 | | C18 | all | `-` followed by 45 `+`, then `NOT + 1` | `NOT` read as a column | nested unary operators | Low | open | | C19 | SQLite | `a IS NULL + 1` | `(a IS NULL) + 1` | `a IS (NULL + 1)` | Low | open | | C20 | SQLite | `a IS NOT DISTINCT FROM 2 <> 3` | `a IS NOT DISTINCT FROM (2 <> 3)` | `(a IS NOT DISTINCT FROM 2) <> 3` | Low | open | | C21 | SQLite | `b LIKE 'x%' = 0` | `b LIKE ('x%' = 0)` | `(b LIKE 'x%') = 0` | Low | open | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
