Skip to content

fix(core,server): harden CTE parser, HTTP status codes, type inference, schema refresh, and build - #15

Merged
lostmygithubaccount merged 1 commit into
mainfrom
cody/db-hardening-batch
Apr 4, 2026
Merged

fix(core,server): harden CTE parser, HTTP status codes, type inference, schema refresh, and build#15
lostmygithubaccount merged 1 commit into
mainfrom
cody/db-hardening-batch

Conversation

@lostmygithubaccount

Copy link
Copy Markdown
Member

Summary

  • CRITICAL: CTE parser string literal bypassstrip_with_prefix() now tracks single-quoted string boundaries when counting parentheses, preventing string literals like '(' from misbalancing the parser and misclassifying writes as reads. Handles escaped quotes ('').
  • HTTP status codes & timeout — errors now return proper status codes (404 not found, 400 validation, 409 conflict, 500 internal) instead of blanket 400. Timeout returns JSON {"error": "..."} body instead of empty response.
  • Type inference silent defaults — unparseable numeric text values now produce NULL instead of silently defaulting to 0/0.0. OLTP NULL columns fall back to PRAGMA table_info for type inference.
  • Schema refresh performance — DDL operations now selectively refresh only the affected table instead of re-introspecting all tables.
  • Build time — removed unused prettyprint arrow feature, restricted tokio dev-dependencies from "full" to specific features.

All 157 tests pass, clippy clean, fmt clean.

🤖 Generated with Claude Code

…e, schema refresh, and build

- fix(core): track single-quoted string boundaries in CTE paren balancer to prevent
  string literals containing parens from misbalancing the parser (security fix)
- fix(server): classify errors into proper HTTP status codes (404 for not found,
  400 for validation, 409 for conflicts, 500 for internal errors)
- fix(server): return JSON body on request timeout instead of empty 408 response
- fix(core): return NULL instead of silently defaulting to 0/0.0 for unparseable
  numeric text values in type conversion
- fix(core): fall back to PRAGMA table_info for NULL column type inference in OLTP
  path instead of always defaulting to Utf8
- perf(core): selective schema refresh after DDL — only refresh the affected table
  instead of all tables
- perf: remove unused prettyprint feature from arrow dependency
- perf: restrict tokio dev-dependencies from "full" to specific features

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@lostmygithubaccount
lostmygithubaccount enabled auto-merge (squash) April 4, 2026 17:32
@lostmygithubaccount
lostmygithubaccount merged commit c0a7472 into main Apr 4, 2026
1 check passed
@lostmygithubaccount
lostmygithubaccount deleted the cody/db-hardening-batch branch April 4, 2026 18:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant