Repository navigation
fix(conn): scrub SQL comment bodies in ScrubQueryText - #56
Merged
Merged
Conversation
Comments are free text — an API key, a token, a customer name — and match none of the literal-shape regexes, so they passed through untouched. pg_stat_statements keeps them verbatim even while normalizing literals to $N, so a tagged query reached --json, MCP, the HTML report and the AI prompt. A small lexer now replaces each comment body with `-- ?` or `/* ? */` before the existing steps. It is a lexer rather than a regex because `--` inside a string or quoted identifier is not a comment, and an apostrophe inside a comment is not a string. Block comments nest; an unterminated comment runs to the end of the text, over-redacting. The fuzzer gains the invariant that whatever a comment holds, only the marker survives. Closes pgrundev#54
2 tasks done
Contributor
|
@lofoneh great!! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Closes #54.
ScrubQueryTextleft comment bodies untouched, and pg_stat_statementskeeps comments verbatim even while normalizing literals:
A small lexer replaces each comment body with
-- ?//* ? */before the existingsteps. A lexer, not a regex:
--inside a string isn't a comment, and'inside acomment isn't a string. Block comments nest; an unterminated one over-redacts.
Verification
--in a literal or quotedidentifier,
don'tin a comment,$1placeholders, nesting).inspect --jsononmain, zero here.scripts/gate.shgreen.Checklist
scripts/gate.shpassesmodel.Context/--json/ the store — this closes a hole