Merge branch 'main' into xmlparse

Author: LucaCappelletti94

.github/workflows/audit.yml

@@ -0,0 +1,48 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Security audit
+
+on:
+  push:
+    branches-ignore:
+      - 'gh-readonly-queue/**'
+    paths:
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+  pull_request:
+    paths:
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+  merge_group:
+  schedule:
+    # Run every day so newly published advisories are caught even when the
+    # dependency tree has not changed.
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - name: Run cargo audit
+        run: cargo audit --deny warnings

Cargo.toml

@@ -36,6 +36,9 @@ edition = "2021"
 name = "sqlparser"
 path = "src/lib.rs"
 
+[lints.rust]
+unsafe_code = "forbid"
+
 [features]
 default = ["std", "recursive-protection"]
 std = []

derive/Cargo.toml

@@ -35,6 +35,9 @@ edition = "2021"
 [lib]
 proc-macro = true
 
+[lints.rust]
+unsafe_code = "forbid"
+
 [dependencies]
 syn = { version = "2.0", default-features = false, features = ["full", "printing", "parsing", "derive", "proc-macro", "clone-impls"] }
 proc-macro2 = "1.0"

examples/cli.rs

@@ -71,9 +71,9 @@ $ cargo run --example cli - [--dialectname]
             .expect("failed to read from stdin");
         String::from_utf8(buf).expect("stdin content wasn't valid utf8")
     } else {
-        println!("Parsing from file '{}' using {:?}", &filename, dialect);
+        println!("Parsing from file '{}' using {:?}", filename, dialect);
         fs::read_to_string(&filename)
-            .unwrap_or_else(|_| panic!("Unable to read the file {}", &filename))
+            .unwrap_or_else(|_| panic!("Unable to read the file {}", filename))
     };
     let without_bom = if contents.chars().next().unwrap() as u64 != 0xfeff {
         contents.as_str()

sqlparser_bench/benches/sqlparser_bench.rs

@@ -245,6 +245,58 @@ fn parse_prefix_case_chain(c: &mut Criterion) {
     group.finish();
 }
 
+/// Benchmark parsing pathological paren chains that previously caused 2^N
+/// work in `parse_table_factor`. The input `SELECT 1 FROM ((((...` rejects
+/// at EOF, which used to force exponential backtracking through the chain.
+fn parse_table_factor_paren_chain(c: &mut Criterion) {
+    let mut group = c.benchmark_group("parse_table_factor_paren_chain");
+    let dialect = GenericDialect {};
+
+    for &n in &[10usize, 20, 30] {
+        let mut sql = String::from("SELECT 1 ");
+        for _ in 0..5 {
+            sql.push_str("FROM ");
+            sql.push_str(&"(".repeat(n));
+            sql.push(' ');
+        }
+
+        group.bench_function(format!("chain_{n}"), |b| {
+            b.iter(|| {
+                let _ = Parser::new(&dialect)
+                    .with_recursion_limit(256)
+                    .try_with_sql(std::hint::black_box(&sql))
+                    .and_then(|mut p| p.parse_statements());
+            });
+        });
+    }
+
+    group.finish();
+}
+
+/// Benchmark parsing pathological `CAST(CASE (CAST(CASE (...` chains that
+/// previously caused 2^N work in `parse_function_args` on dialects with
+/// expression-named function arguments (the argument expression was parsed
+/// once to detect the named form, then re-parsed on the unnamed path).
+fn parse_function_arg_call_chain(c: &mut Criterion) {
+    let mut group = c.benchmark_group("parse_function_arg_call_chain");
+    let dialect = PostgreSqlDialect {};
+
+    for &n in &[10usize, 20, 30] {
+        let sql = String::from("SELECT ") + &"CAST(CASE (".repeat(n) + &")".repeat(n);
+
+        group.bench_function(format!("chain_{n}"), |b| {
+            b.iter(|| {
+                let _ = Parser::new(&dialect)
+                    .with_recursion_limit(256)
+                    .try_with_sql(std::hint::black_box(&sql))
+                    .and_then(|mut p| p.parse_statements());
+            });
+        });
+    }
+
+    group.finish();
+}
+
 criterion_group!(
     benches,
     basic_queries,
@@ -253,6 +305,8 @@ criterion_group!(
     parse_compound_chain,
     parse_compound_keyword_chain,
     parse_prefix_keyword_call_chain,
-    parse_prefix_case_chain
+    parse_prefix_case_chain,
+    parse_table_factor_paren_chain,
+    parse_function_arg_call_chain
 );
 criterion_main!(benches);

src/ast/data_type.rs

@@ -720,6 +720,8 @@ impl fmt::Display for DataType {
                 ArrayElemTypeDef::SquareBracket(t, Some(size)) => write!(f, "{t}[{size}]"),
                 ArrayElemTypeDef::AngleBracket(t) => write!(f, "ARRAY<{t}>"),
                 ArrayElemTypeDef::Parenthesis(t) => write!(f, "Array({t})"),
+                ArrayElemTypeDef::Qualified(t, None) => write!(f, "{t} ARRAY"),
+                ArrayElemTypeDef::Qualified(t, Some(size)) => write!(f, "{t} ARRAY[{size}]"),
             },
             DataType::Custom(ty, modifiers) => {
                 if modifiers.is_empty() {
@@ -1163,6 +1165,8 @@ pub enum ArrayElemTypeDef {
     SquareBracket(Box<DataType>, Option<u64>),
     /// Parenthesis style, e.g. `Array(Int64)`.
     Parenthesis(Box<DataType>),
+    /// Qualified by a data type and optional size, e.g. `INT ARRAY` or `INT ARRAY[4]`.
+    Qualified(Box<DataType>, Option<u64>),
 }
 
 /// Represents different types of geometric shapes which are commonly used in