You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(eql): schema-qualify operators in comparison wrapper bodies - #1551
Fixes CIP-5153. The _ord_ore comparison functions (eql_v3.lt, lte, gt, gte, eq, neq) gave silently wrong answers when public was not on the caller's search_path.
The wrappers are unpinned LANGUAGE sql so they inline into functional-index scans, which means PostgreSQL parses their bodies under the caller's search_path. The ORE wrappers compare eql_v3_internal.ore_block_256, a composite type whose operators are created in public. Without public on the path (a SECURITY DEFINER helper with SET search_path = '', as Supabase recommends, or a hardened role path), the bare < resolved to pg_catalog's built-in record comparison, ordering the ciphertext bytes with no error. Reproduced on PostgreSQL 16: a malformed pair raises "Ciphertexts are different lengths" on the default path and returns t under search_path = ''.
Changes
eql-domains: new Term::operator_schema() (public for ORE, pg_catalog for HMAC, bloom and OPE) and Term::term_for_operator(); extractor_for_operator now delegates to it.
eql-codegen: wrapper_entry takes the serving Term and emits OPERATOR(<schema>.<op>); the bloom empty-needle guard qualifies cardinality and its operators too. All generated wrapper SQL under src/v3/scalars/ is regenerated (body lines only).
src/v3/json/operators.sql: the four hand-written json_entry ordering wrappers name OPERATOR(pg_catalog.<op>).
skills/stash-postgres: a new trap entry on querying encrypted columns when public is off the search_path (a bare col < $1 still falls back to native jsonb there; use the function form or OPERATOR(public.<)).
cargo test -p eql-domains -p eql-codegen: green apart from two tests that fail when run as root (generate_type_failure_does_not_delete_before_writing, write_failure_preserves_existing_target_and_leaves_no_temp); they fail the same way on main in this environment.
New codegen test every_wrapper_body_schema_qualifies_its_operators checks every generated wrapper body across the catalog: no bare operator token, and the right schema per term (literal, so a wrong operator_schema mapping fails it; confirmed by flipping ORE to pg_catalog).
New SQLx suite v3_search_path_independence_tests: every ORE-carrying domain's wrappers, query-twin overloads and OPERATOR(public.<op>) forms under search_path = '', checked against compare_ore_block_256_terms on pairs where ORE order and byte order disagree; plus a SET search_path = ''SECURITY DEFINER helper on a malformed pair. Red on the published 3.0.6 installer, green on this branch (local PostgreSQL 16).
Fixture-free SQLx suites pass locally: lint_tests, v3_public_surface_tests, v3_operator_equivalents_tests, v3_jsonb_operator_surface_tests, v3_ore_fallback_tests, build_validation_tests, payload_schema_tests. Suites needing ZeroKMS-generated fixtures were not run locally (no credentials); CI runs them.
Index engagement checked by hand: EXPLAIN on c < query and on eql_v3.lt(c, query) under search_path = '' both use the eql_v3.ord_term_ore(c) btree index.
cargo fmt --check, cargo clippy clean.
Related
CIP-5153. CIP-3324 qualified the SEM operator DDL; this closes the wrapper side.
Bare col < q with public off the path still resolves to native jsonb. That is the cross-family fall-through tracked in CIP-5155, out of scope here; the changeset and skill say so.
The release SQL bundles (packages/eql/packages/eql/sql, crates/eql-bindings/sql) are left alone; the release version hook rebuilds them when this changeset bumps EQL.
Encrypted-column comparisons now resolve consistently even when public is absent from PostgreSQL’s search_path, preventing incorrect results from unintended built-in comparisons.
Generated comparison functions remain eligible for inlining. Bare operators on encrypted columns still require public in the search path.
Documentation
Added guidance on querying encrypted columns without public in the search path. EQL must be reinstalled or upgraded to use the fix.
The eql_v3 comparison wrappers (eql_v3.lt, eq, ...) are unpinned
LANGUAGE sql functions so they can inline into functional-index scans,
which means PostgreSQL parses their bodies under the caller's
search_path. The _ord_ore wrappers compare eql_v3_internal.ore_block_256,
a composite type whose comparison operators are created in public. With
public off the path (a SECURITY DEFINER helper with SET search_path = '',
or a hardened role path) the bare < in the body resolved to pg_catalog's
built-in record comparison instead, ordering the ciphertext bytes with
no error.
The generator now names every wrapper operator with its schema, taken
from a new Term::operator_schema (public for ORE, pg_catalog for the
HMAC, bloom and OPE terms), and the bloom guard qualifies cardinality
too. Inlining and index engagement are unchanged: the inlined
expression carries the same operator either way. The four hand-written
json_entry ordering wrappers get the same treatment.
Tests: a codegen test checks every generated wrapper body across the
catalog uses no bare operator and names the right schema per term, and
a new SQLx suite runs every ORE-carrying domain's wrappers and
OPERATOR(public.<op>) forms under search_path = '' against the ORE
comparator, on pairs where it disagrees with byte order (red on the
previous installer, green now).
Refs: CIP-5153
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Jmn7p5byuYMWqoxDUAZQE
No actionable comments were generated in the recent review.
Walkthrough
EQL comparison wrappers now qualify operators by schema, including generated wrappers and SQL functions across scalar types. Integration tests exercise comparison behavior with an empty PostgreSQL search_path. The Changeset and PostgreSQL skill document the update and usage constraints.
Select and emit qualified operators packages/eql/crates/eql-domains/src/term.rs, packages/eql/crates/eql-codegen/src/context.rs, packages/eql/crates/eql-codegen/src/generate.rs, packages/eql/crates/eql-codegen/templates/functions/wrapper.sql.j2
Term metadata maps ORE operators to public and other term operators to pg_catalog. Code generation passes terms into wrapper construction and emits qualified operators.
SQL comparison wrappers qualify operators. ORE comparisons use public; other comparison operators use pg_catalog. Existing operand casts and comparison directions are retained.
Verify and document search-path behavior packages/eql/tests/sqlx/tests/v3_search_path_independence_tests.rs, skills/stash-postgres/SKILL.md, .changeset/eql-wrapper-operators-search-path.md
Integration tests cover comparison results, malformed ORE terms, and HMAC equality with an empty search path. The skill and Changeset describe operator usage and the remaining public schema requirement for bare operators.
This change makes encrypted-column comparison functions return correct results when public is not on the search_path. No concrete merge-blocking issue was found. Some fixture-dependent tests are left to CI.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title clearly summarizes the main change: schema-qualifying operators in comparison wrapper bodies.
Docstring Coverage
Docstring coverage is 82.35% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentati…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
Docstring coverage is 82.35% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 17 functions across 4 files. (89 skipped: 89 unsupported.)
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.
test:public_identifiers forbids private issue identifiers in tracked
files; describe the behaviour directly instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Jmn7p5byuYMWqoxDUAZQE
The reason will be displayed to describe this comment to others. Learn more.
Review attestation
Reviewed 63da8b3 · posted from Claude Code · claude-sonnet-5-5 · effort medium
Sources: code-review (medium) · claude-sonnet-5-5
Skills: code-review, review-cross-check, review-post
No findings.
Scope read: eql-codegen (context.rs, generate.rs, wrapper template), eql-domains/src/term.rs, json/operators.sql, the new SQLx suite, changeset and skill edit. The regenerated v3/scalars/* SQL was spot-checked via the generator tests, not line by line. No existing review threads; the one failed Blacksmith check (private-identifier scan) was on an earlier run and ci-required later passed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cipherstash-agent
left a comment
Requested by CipherStash · project thread
Summary
Fixes CIP-5153. The
_ord_orecomparison functions (eql_v3.lt,lte,gt,gte,eq,neq) gave silently wrong answers whenpublicwas not on the caller'ssearch_path.The wrappers are unpinned
LANGUAGE sqlso they inline into functional-index scans, which means PostgreSQL parses their bodies under the caller'ssearch_path. The ORE wrappers compareeql_v3_internal.ore_block_256, a composite type whose operators are created inpublic. Withoutpublicon the path (aSECURITY DEFINERhelper withSET search_path = '', as Supabase recommends, or a hardened role path), the bare<resolved to pg_catalog's built-in record comparison, ordering the ciphertext bytes with no error. Reproduced on PostgreSQL 16: a malformed pair raises "Ciphertexts are different lengths" on the default path and returnstundersearch_path = ''.Changes
eql-domains: newTerm::operator_schema()(publicfor ORE,pg_catalogfor HMAC, bloom and OPE) andTerm::term_for_operator();extractor_for_operatornow delegates to it.eql-codegen:wrapper_entrytakes the servingTermand emitsOPERATOR(<schema>.<op>); the bloom empty-needle guard qualifiescardinalityand its operators too. All generated wrapper SQL undersrc/v3/scalars/is regenerated (body lines only).src/v3/json/operators.sql: the four hand-written json_entry ordering wrappers nameOPERATOR(pg_catalog.<op>).skills/stash-postgres: a new trap entry on querying encrypted columns whenpublicis off thesearch_path(a barecol < $1still falls back to native jsonb there; use the function form orOPERATOR(public.<)).@cipherstash/eqlpatch,stashpatch (skill).Verification
cargo test -p eql-domains -p eql-codegen: green apart from two tests that fail when run as root (generate_type_failure_does_not_delete_before_writing,write_failure_preserves_existing_target_and_leaves_no_temp); they fail the same way onmainin this environment.every_wrapper_body_schema_qualifies_its_operatorschecks every generated wrapper body across the catalog: no bare operator token, and the right schema per term (literal, so a wrongoperator_schemamapping fails it; confirmed by flipping ORE topg_catalog).v3_search_path_independence_tests: every ORE-carrying domain's wrappers, query-twin overloads andOPERATOR(public.<op>)forms undersearch_path = '', checked againstcompare_ore_block_256_termson pairs where ORE order and byte order disagree; plus aSET search_path = ''SECURITY DEFINERhelper on a malformed pair. Red on the published 3.0.6 installer, green on this branch (local PostgreSQL 16).lint_tests,v3_public_surface_tests,v3_operator_equivalents_tests,v3_jsonb_operator_surface_tests,v3_ore_fallback_tests,build_validation_tests,payload_schema_tests. Suites needing ZeroKMS-generated fixtures were not run locally (no credentials); CI runs them.EXPLAINonc < queryand oneql_v3.lt(c, query)undersearch_path = ''both use theeql_v3.ord_term_ore(c)btree index.cargo fmt --check,cargo clippyclean.Related
generate.rsand the generatedquery_*SQL, so whichever lands second needs a rebase and acargo run -p eql-codegenregenerate.Review notes
col < qwithpublicoff the path still resolves to native jsonb. That is the cross-family fall-through tracked in CIP-5155, out of scope here; the changeset and skill say so.packages/eql/packages/eql/sql,crates/eql-bindings/sql) are left alone; the release version hook rebuilds them when this changeset bumps EQL.Generated by Claude Code
Summary by CodeRabbit
publicis absent from PostgreSQL’ssearch_path, preventing incorrect results from unintended built-in comparisons.publicin the search path.publicin the search path. EQL must be reinstalled or upgraded to use the fix.