parse_sparql returns after parsing one operation with no trailing-token check (fluree-db-sparql/src/parse/query/mod.rs:40-74,193-207); parse_and_lower_sparql_update lowers that single body. A request like INSERT DATA {...} ; DELETE WHERE {...} commits the INSERT and silently discards everything after the first ; — verified end-to-end through graph().transact().sparql_update().commit() with readback (W3C basic-update#insert-05a is a 5-op request that demonstrates it).
This is silent data loss for any client sending standard multi-op SPARQL UPDATE.
Interim mitigation (decision D-10a, approved): reject requests with trailing tokens with a loud parse error. Full fix: request-level sequential staging of ops within one atomic commit (roadmap PR-U2, gated on the Txn IR shape decision D-10b).
Found and verified by the W3C SPARQL burn-down audit (PR #1437; docs/audit/burn-down/ROADMAP.md §5 on branch test/sparql-testsuite-full-coverage).
parse_sparqlreturns after parsing one operation with no trailing-token check (fluree-db-sparql/src/parse/query/mod.rs:40-74,193-207);parse_and_lower_sparql_updatelowers that single body. A request likeINSERT DATA {...} ; DELETE WHERE {...}commits the INSERT and silently discards everything after the first;— verified end-to-end throughgraph().transact().sparql_update().commit()with readback (W3Cbasic-update#insert-05ais a 5-op request that demonstrates it).This is silent data loss for any client sending standard multi-op SPARQL UPDATE.
Interim mitigation (decision D-10a, approved): reject requests with trailing tokens with a loud parse error. Full fix: request-level sequential staging of ops within one atomic commit (roadmap PR-U2, gated on the Txn IR shape decision D-10b).
Found and verified by the W3C SPARQL burn-down audit (PR #1437;
docs/audit/burn-down/ROADMAP.md§5 on branchtest/sparql-testsuite-full-coverage).