You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@datafusion.apache.org by "LucaCappelletti94 (via GitHub)" <gi...@apache.org> on 2026/02/06 08:45:19 UTC
[PR] Fix panic in `SET AUTHORIZATION` parsing when scope modifier is missing [datafusion-sqlparser-rs]
LucaCappelletti94 opened a new pull request, #2201:
URL: https://github.com/apache/datafusion-sqlparser-rs/pull/2201
Parsing `SET AUTHORIZATION <value>` without a scope modifier (e.g. `SESSION`, `LOCAL`) causes a panic due to an `.expect()` call on a `None` value in `parse_set`. This was discovered via a fuzz-like input string but is trivially reproducible with any `SET AUTHORIZATION ...` statement that omits the scope keyword.
The panic occurs at mod.rs:
```rust
scope: scope.expect("SET ... AUTHORIZATION must have a scope"),
```
Valid SQL requires a scope modifier, e.g. `SET SESSION AUTHORIZATION 'user'`, so the missing scope is indeed an error — but it should be a graceful `ParserError`, not a panic.
Closes #2200
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Fix panic in `SET AUTHORIZATION` parsing when scope modifier is missing [datafusion-sqlparser-rs]
Posted by "LucaCappelletti94 (via GitHub)" <gi...@apache.org>.
LucaCappelletti94 commented on code in PR #2201:
URL: https://github.com/apache/datafusion-sqlparser-rs/pull/2201#discussion_r2786774389
##########
tests/sqlparser_common.rs:
##########
@@ -18273,6 +18273,18 @@ fn test_parse_set_session_authorization() {
);
}
+#[test]
+fn test_set_authorization_without_scope_errors() {
+ // This should return a parser error, not panic.
+ let res = parse_sql_statements(
+ "\tSET\t\t\t\t\t\t\t\t\t\tAUTHORIZATION\tTIME\t\t\t\t\t\tTIME\u{fffd}\u{fffd}v\u{1}\0\0\t74843EUTI>\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0USER_RNCLUDE_NULL\0\0\0\0\0\0\0\0\0\t\t\t\t^^^^^^^^\tWHI\t\tIN"
Review Comment:
Could be, but I thought it was small enough of a crash case
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Fix panic in `SET AUTHORIZATION` parsing when scope modifier is missing [datafusion-sqlparser-rs]
Posted by "iffyio (via GitHub)" <gi...@apache.org>.
iffyio commented on code in PR #2201:
URL: https://github.com/apache/datafusion-sqlparser-rs/pull/2201#discussion_r2777139920
##########
tests/sqlparser_common.rs:
##########
@@ -18273,6 +18273,18 @@ fn test_parse_set_session_authorization() {
);
}
+#[test]
+fn test_set_authorization_without_scope_errors() {
+ // This should return a parser error, not panic.
+ let res = parse_sql_statements(
+ "\tSET\t\t\t\t\t\t\t\t\t\tAUTHORIZATION\tTIME\t\t\t\t\t\tTIME\u{fffd}\u{fffd}v\u{1}\0\0\t74843EUTI>\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0USER_RNCLUDE_NULL\0\0\0\0\0\0\0\0\0\t\t\t\t^^^^^^^^\tWHI\t\tIN"
Review Comment:
is there a simpler test case that reproduces the error? I'm assuming the escape sequences and null characters shouldnt be necessary based on the diff
##########
src/parser/mod.rs:
##########
@@ -14515,8 +14515,13 @@ impl<'a> Parser<'a> {
let value = self.parse_identifier()?;
SetSessionAuthorizationParamKind::User(value)
};
+ let scope = scope.ok_or_else(|| {
+ ParserError::ParserError(
+ "Expected a scope modifier (e.g. SESSION) before AUTHORIZATION".to_string(),
+ )
Review Comment:
can we use one of the helper functions like `self.expected_at`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Fix panic in `SET AUTHORIZATION` parsing when scope modifier is missing [datafusion-sqlparser-rs]
Posted by "LucaCappelletti94 (via GitHub)" <gi...@apache.org>.
LucaCappelletti94 commented on code in PR #2201:
URL: https://github.com/apache/datafusion-sqlparser-rs/pull/2201#discussion_r2786775811
##########
src/parser/mod.rs:
##########
@@ -14515,8 +14515,13 @@ impl<'a> Parser<'a> {
let value = self.parse_identifier()?;
SetSessionAuthorizationParamKind::User(value)
};
+ let scope = scope.ok_or_else(|| {
+ ParserError::ParserError(
+ "Expected a scope modifier (e.g. SESSION) before AUTHORIZATION".to_string(),
+ )
Review Comment:
Ok
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Fix panic in `SET AUTHORIZATION` parsing when scope modifier is missing [datafusion-sqlparser-rs]
Posted by "iffyio (via GitHub)" <gi...@apache.org>.
iffyio merged PR #2201:
URL: https://github.com/apache/datafusion-sqlparser-rs/pull/2201
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org