[OffgridwithJD]

Summary

Found while reviewing the new plxlua front end. The problem is in the shared code, so it affects every dialect that hoists DECLAREs.

Type annotations could carry code

A local's type is spliced into the plpgsql DECLARE section, and plpgsql reads a declaration up to its ;. So anything after the type in an annotation became part of the declaration:

Source	Generated	Effect
x #:: int := (SELECT ...)	x int := (SELECT ...);	runs a query on entry
let x /*:: int DEFAULT 42 */;	x int DEFAULT 42;	plxjs source that reads as let x; returns 42
x #:: int; BEGIN ... END; DECLARE y int	spliced as statements

This is the same class as the string-literal breakout in #12: the source shows only a type (in plxjs, only a comment), but other code runs. I confirmed that set_config('search_path', ...) in an annotation initializer runs and changes the caller's setting.

Fix. Before a type reaches DECLARE it must be one of these, with no comment in it:

• name%TYPE or name%ROWTYPE, optionally qualified, optionally followed by []
• a type name the SQL type-name grammar accepts. The check uses typeStringToTypeName, the same parser plpgsql's own parse_datatype uses.

The check runs where DECLARE is assembled, so it covers:

• annotations in every dialect
• plxts types
• plxgo and plxtsql declarations
• the plxcobol TYPE clause
• the new dialects (plxlua, plxcsharp), with no work on their side

Why this is sound. plpgsql's read_datatype stops at :=, =, DEFAULT, NOT and COLLATE, and at , or ) outside parentheses. None of these can appear at the top level of a SQL type name. When one appears inside a type modifier, plpgsql hands an unbalanced prefix to parse_datatype, which fails. So any text that passes the check is either consumed whole as the type or rejected by plpgsql. Comments (--, /*) are rejected up front, because the SQL parser skips them but a -- would hide the declaration's ;.

Only syntax errors from the parser are turned into the plx error. Any other error is re-thrown unchanged.

Annotation before an initializer dropped the initializer

In plxjs and plxphp, let n /*:: bigint */ = 3; was treated as a bare annotation, and the = 3 was silently dropped, leaving n NULL. It is now rejected with a hint to write let n = 3 /*:: bigint */;, the documented form.

Compatibility

Code-only, so no ALTER EXTENSION is needed. A function whose annotation held anything but a type is now rejected at CREATE FUNCTION. Every documented form still works, and a new test covers them:

• double precision
• timestamp(3) with time zone
• numeric(10, 2)
• character varying(20)[]
• %ROWTYPE and qualified %TYPE
• quoted qualified names
• int[][]
• interval day to second

Cost

One raw parse per distinct type, about 2 µs each. Consecutive locals with the same type are checked once. With #12's locals hash, a body of 40,000 locals that each have a different type transpiles in 0.12 s.

Testing

• make installcheck: all 13 suites pass on PG 18.4. CI covers 13 to 18. The version split (typeStringToTypeName gained an escontext argument in 16) is handled with #if.
• make differentialcheck: 0 unexplained.
• New cases in plx_errors: six rejected annotations across plxruby, plxjs and plxpython3; the two misplaced-annotation cases; and the accepted forms above.

🤖 Generated with Claude Code