Repository navigation
[FUZZER LLM TRIAGE] Expression misreads in the PostgreSQL and SQLite dialects #2840
Description
Severity uses the CVSS words, Critical for silently dropped input, High for a different result, Medium for rejected valid SQL or unparseable output, Low for deep nesting or rare operator mixes, and None for a different tree with the same result.
| Class | Dialect | SQL | sqlparser reads | engine reads | Severity | Status |
|---|---|---|---|---|---|---|
| C1 | all | SELECT 1 END; SELECT 2 |
SELECT 1, the rest is dropped without an error |
SELECT 1 AS "end"; SELECT 2 |
Critical | #2838 |
| C22 | PostgreSQL | SELECT a &>b FROM t |
SELECT (a &> FROM) AS t, the b is consumed with &> |
SELECT a &> b FROM t |
Critical | open |
| C2 | PostgreSQL | -2 ^ 2 |
-(2 ^ 2) |
(-2) ^ 2 |
High | #2819, #2829 |
| C3 | PostgreSQL | |/ a + 3 |
(|/ a) + 3 |
|/ (a + 3) |
High | #814 |
| C4 | PostgreSQL | x = 'a' ~ 'b' |
(x = 'a') ~ 'b' |
x = ('a' ~ 'b') |
High | open |
| C5 | PostgreSQL | a>=-1 |
custom operator >=- applied to 1 |
a >= (-1) |
High | open |
| C6 | PostgreSQL, SQLite | a ISNULL |
a AS ISNULL |
a IS NULL |
High | #2786 |
| C7 | SQLite | ~ a * 2 |
~ (a * 2) |
(~ a) * 2 |
High | open |
| C8 | SQLite | a * 2 || 'x' |
(a * 2) || 'x' |
a * (2 || 'x') |
High | open |
| C9 | SQLite | b ->> '$.n' + 1 |
b ->> ('$.n' + 1) |
(b ->> '$.n') + 1 |
High | open |
| C23 | SQLite | 0x1F + 1 |
X'1F' + 1, a blob literal |
31 + 1 |
High | open |
| C25 | SQLite | a<@p |
operator <@ applied to p |
a < @p, a named parameter |
High | open |
| C10 | PostgreSQL | OPERATOR(pg_catalog.-) 1 + 2 |
rejected | OPERATOR(pg_catalog.-) (1 + 2) |
Medium | open |
| C11 | PostgreSQL | 1::textor(NOT NOT 1) |
prints textor(NOT, NOT, 1), which PostgreSQL rejects |
modifier is the expression NOT (NOT 1) |
Medium | open |
| C12 | PostgreSQL | a BETWEEN SYMMETRIC 1 AND 2 |
rejected | BETWEEN SYMMETRIC |
Medium | #2522 |
| C13 | SQLite | a NOT NULL COLLATE BINARY = 1 |
rejected | ((a NOT NULL) COLLATE BINARY) = 1 |
Medium | open |
| C14 | SQLite | b NOT GLOB 'x*' |
rejected | NOT (b GLOB 'x*') |
Medium | open |
| C15 | PostgreSQL | a OPERATOR(pg_catalog.+) 1 ?| b |
a OPERATOR(pg_catalog.+) (1 ?| b) |
(a OPERATOR(pg_catalog.+) 1) ?| b |
Low | open |
| C16 | PostgreSQL | $1IS NULL |
placeholder $1IS |
error trailing junk after parameter |
Low | open |
| C17 | all | a = ANY(SELECT 1) + 1 |
a = ANY((SELECT 1) + 1) |
(a = ANY(SELECT 1)) + 1 |
Low | #2802 |
| C18 | all | - followed by 45 +, then NOT + 1 |
NOT read as a column |
nested unary operators | Low | open |
| C19 | SQLite | a IS NULL + 1 |
(a IS NULL) + 1 |
a IS (NULL + 1) |
Low | open |
| C20 | SQLite | a IS NOT DISTINCT FROM 2 <> 3 |
a IS NOT DISTINCT FROM (2 <> 3) |
(a IS NOT DISTINCT FROM 2) <> 3 |
Low | open |
| C21 | SQLite | b LIKE 'x%' = 0 |
b LIKE ('x%' = 0) |
(b LIKE 'x%') = 0 |
Low | open |
| C24 | PostgreSQL, SQLite | NOT EXISTS (SELECT 1) = false |
(NOT EXISTS (SELECT 1)) = false |
NOT (EXISTS (SELECT 1) = false) |
Low | open |
| C26 | PostgreSQL | a LIKE ANY (b) ::text |
a LIKE ANY ((b)::text) |
(a LIKE ANY (b))::text |
Low | open |
| C27 | PostgreSQL | + @ 1 |
prints +@ 1, which PostgreSQL lexes as the single operator +@ |
+ (@ 1) |
Medium | #2424 |
| C28 | SQLite | 0 NOT NULL + 1 |
prints 0 IS NOT NULL + 1, which SQLite reads as 0 IS NOT (NULL + 1) |
(0 NOT NULL) + 1 |
Medium | open |
Reacted by Dmitri B.
Activity