You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pinot.apache.org by "xiangfu0 (via GitHub)" <gi...@apache.org> on 2026/08/24 21:37:51 UTC
Re: [PR] Add SQL input sanitization utilities [pinot]
xiangfu0 commented on code in PR #19352:
URL: https://github.com/apache/pinot/pull/19352#discussion_r3847674536
##########
pinot-common/src/main/java/org/apache/pinot/sql/parsers/ParserUtils.java:
##########
@@ -18,14 +18,41 @@
*/
package org.apache.pinot.sql.parsers;
+import java.util.ArrayList;
import java.util.List;
+import java.util.Objects;
+import java.util.StringJoiner;
import org.apache.pinot.common.request.Expression;
+import org.apache.pinot.common.request.ExpressionType;
+import org.apache.pinot.spi.utils.SqlUtils;
public class ParserUtils {
private ParserUtils() {
}
+ /// Converts a raw or SQL-quoted identifier into a safe SQL identifier fragment. Qualified identifiers are split on
+ /// dots outside quoted components. Valid bare Pinot identifier components and wildcards remain bare, while other
+ /// components are double-quoted. Backtick-quoted and double-quoted components are normalized to double quotes.
+ ///
+ /// @param identifier Raw or SQL-quoted identifier, optionally qualified
+ /// @return Identifier formatted for use in a SQL statement
+ /// @throws NullPointerException If the identifier is null
+ /// @throws IllegalArgumentException If the identifier is empty or has invalid quoted structure
+ public static String sanitizeIdentifier(String identifier) {
+ Objects.requireNonNull(identifier, "identifier cannot be null");
Review Comment:
Removed the explicit null check. The unannotated identifier argument now follows Pinot non-null conventions.
##########
pinot-common/src/main/java/org/apache/pinot/sql/parsers/ParserUtils.java:
##########
@@ -18,14 +18,41 @@
*/
package org.apache.pinot.sql.parsers;
+import java.util.ArrayList;
import java.util.List;
+import java.util.Objects;
+import java.util.StringJoiner;
import org.apache.pinot.common.request.Expression;
+import org.apache.pinot.common.request.ExpressionType;
+import org.apache.pinot.spi.utils.SqlUtils;
public class ParserUtils {
private ParserUtils() {
}
+ /// Converts a raw or SQL-quoted identifier into a safe SQL identifier fragment. Qualified identifiers are split on
+ /// dots outside quoted components. Valid bare Pinot identifier components and wildcards remain bare, while other
+ /// components are double-quoted. Backtick-quoted and double-quoted components are normalized to double quotes.
+ ///
+ /// @param identifier Raw or SQL-quoted identifier, optionally qualified
+ /// @return Identifier formatted for use in a SQL statement
+ /// @throws NullPointerException If the identifier is null
+ /// @throws IllegalArgumentException If the identifier is empty or has invalid quoted structure
+ public static String sanitizeIdentifier(String identifier) {
+ Objects.requireNonNull(identifier, "identifier cannot be null");
+ String trimmed = identifier.trim();
+ if (trimmed.isEmpty()) {
+ throw new IllegalArgumentException("identifier cannot be empty");
+ }
+
+ StringJoiner result = new StringJoiner(".");
Review Comment:
Added a fast path for identifiers with no `.`, backtick, or double quote. It avoids qualified-name splitting and `StringJoiner` allocation while preserving `*` through the segment sanitizer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org