fix: complete TablesNamesFinder traversal for piped queries, DML side clauses and analytic functions (#2478) - #2479
Merged
manticore-projects merged 1 commit intoAug 17, 2026
Conversation
… clauses and analytic functions (JSQLParser#2478) Silently missed tables or threw for: piped queries (visit(FromQuery) was empty, now implements PipeOperatorVisitor), DELETE WITH lists (CTE tables lost, CTE alias leaked as phantom table), MERGE ON condition and WHEN operations (now implements MergeOperationVisitor), INSERT SET / ON DUPLICATE KEY UPDATE / ON CONFLICT actions and OUTPUT / RETURNING clauses of INSERT / UPDATE / DELETE, data modifying CTEs (ClassCastException in WithItem.getSelect(), dispatch any ParenthesedStatement instead) and analytic functions with function level ORDER BY (NPE), window ORDER BY or FILTER clause. Signed-off-by: 付典 <fudianchn@gmail.com>
Contributor
|
Great work, thank you much for fixing this! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Completes the visitor traversal of
TablesNamesFinderfor piped queries (FromQuery+ all pipe operators), theWITHlist ofDELETE, theONcondition andWHENoperations ofMERGE, theSETlist,ON DUPLICATE KEY UPDATE/ON CONFLICT ... DO UPDATEactions andOUTPUT/RETURNINGclauses of the DML statements, data modifying CTE payloads and theORDER BY/FILTERparts of analytic functions.Why
TablesNamesFinderis the documented entry point for SQL auditing / firewall use cases; four of the gaps silently return an incomplete table list and two throw. Fixes #2478.How
visit(FromQuery)traverses theWITHlist, the from item and all pipe operators;TablesNamesFindernow implementsPipeOperatorVisitor(mirroringSelectDeParser).visit(Delete)traverseswithItemsListlikevisit(Update)/visit(Insert)already do.visit(Merge)traversesonConditionand all operations;TablesNamesFindernow implementsMergeOperationVisitor.visit(Insert)traversessetUpdateSets,duplicateAction,conflictAction(via the existingExpressionVisitor.visitUpdateSetsdefault); all three DML visits traverseoutputClause(overriding theSelectVisitordefault) andreturningClause.visit(WithItem)dispatches the payload as anyParenthesedStatementinstead of casting viagetSelect(), which fixes data modifying CTEs.visit(AnalyticExpression)traversesfuncOrderByandorderByElementsindependently and addsfilterExpression.The parser, grammar and deparser are untouched, so there is no impact on parsing performance.
Root cause
Visitor coverage in
TablesNamesFinderwas incomplete: newer AST families (piped queries, merge operations, insert actions, output / returning clauses) were never wired up, and two pre-existing guards were wrong (getSelect()cast,getFuncOrderBy()checked butgetOrderByElements()iterated).Testing
TablesNamesFinderTest; all 14 fail on masterf41c0b8(missing tables,ClassCastException,NullPointerException) and pass with this change:./gradlew test --tests net.sf.jsqlparser.util.TablesNamesFinderTest-> 85 tests, 0 failures../gradlew spotlessApply check-> 4854 tests, 0 failures.Verification of the original issue
f41c0b8[]DELETEwithWITH[cte, MY_TABLE1][MY_TABLE1, MY_TABLE2]MERGEwith subqueries[src, MY_TABLE1]INSERT ... ON DUPLICATE KEY UPDATE[MY_TABLE1][MY_TABLE1, MY_TABLE2]WITH del AS (DELETE ...)ClassCastException[MY_TABLE1, MY_TABLE2]string_agg(...) OVER (...)NullPointerException[MY_TABLE1]Fixes #2478