feat(query)!: harden structured SQL boundaries - #21
Open
abdul-kaioum wants to merge 11 commits into
Open
Conversation
Preserve logical-to-physical qualification while validating and quoting every structured column segment. BREAKING CHANGE: unknown or schema-qualified names and pre-quoted structured identifiers now fail closed; register the table or alias, or use a reviewed raw API.
Validate finite operators, join types, identifiers, and boolean connectors before execution. Split join operands into column, bound-value, and explicit raw APIs. BREAKING CHANGE: structured table declarations are quoted and ordinary join/on operands must be columns; use joinWhere/onValue for values and onRaw for expressions.
Compile UPDATE bindings in placeholder order, constrain operators by clause shape, reject unsupported FULL joins, and qualify bare columns through active base aliases.
Normalize array-valued WHERE and HAVING operators through the list boundary, compile empty lists safely, and reject undeclared base aliases on UPDATE and DELETE.
Keep generated relation aggregates, subqueries, and pivot projections in structured state so identifiers and aliases reach the shared renderer before execution.
Map logical and physical base-table qualifiers to the active SELECT alias at the rendering boundary, and document the strict quoted identifier behavior.
Resolve registered aliases before remapping hidden base-table qualifiers to the active FROM alias, preventing colliding join aliases from collapsing onto the base.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Hardens wp-database 2.x across identifier rendering, structured clauses, joins, relationships, writes, and raw SQL. Adds typed identifier/operator/join/raw-template primitives and comprehensive regression coverage for SQL structure injection.
Motivation & Context
Prepared value bindings do not protect table names, columns, sort directions, operators, join types, or raw SQL fragments. This change makes those structural boundaries explicit, rejects malformed input early, and provides a typed raw-template API for the rare cases where raw SQL is required.
Type of Change
Security Behavior
RawTemplateseparates value bindings from typed identifiers and directions.Breaking Changes
This PR intentionally rejects SQL structure that older versions accepted implicitly. See
docs/breaking-changes.mdanddocs/usage.mdfor migration guidance. The branch alias is prepared for the 2.x line; no tag or release is created by this PR.Verification
Checklist