fix: only run nested sub-query for SELECT templates with ${...} (#4) - #52
Merged
Conversation
In mysql_replicator (single), any column value beginning with "SELECT"
triggered an unintended nested sub-query, so ordinary text data starting
with the word "SELECT" was executed as SQL.
Require a ${placeholder} before treating a value as a sub-query template,
using the same regex already applied to mysql_replicator_multi in #6
(/^SELECT[^\$]+\$\{[^\}]+\}/i). The single plugin — the file #4 was
reported against — never received that fix; this brings the two in line.
Extract the predicate as nested_query_value? and add regression tests
covering a real template, plain text starting with "SELECT", the word
"Selecting", a SELECT without a placeholder, and non-string values.
Closes #4
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jun 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #4: in
mysql_replicator(single), a column value that merely begins with "SELECT" triggered an unintended nested sub-query, so ordinary text data could be executed as SQL.Background — why #4 was still open
The maintainer proposed the correct fix back in 2014 and #6 applied it — but only to
in_mysql_replicator_multi.rb:in_mysql_replicator_multi.rb)/^SELECT[^\$]+\$\{[^\}]+\}/i✅ (fixed in #6)in_mysql_replicator.rb)/^SELECT(\s+)/i❌ still fires without a placeholder#4 was reported against the single plugin, which never received the fix. This PR ports the proven
multiregex tosingleso the two behave consistently.Fix
Require a
${placeholder}before treating a value as a sub-query template, and extract the predicate for testing:So
"SELECT * FROM child WHERE parent_id = ${id}"still nests, while a data value like"SELECT YOUR PLAN"is left alone.Tests
Added regression tests: a real template (true), plain text starting with "SELECT", the word "Selecting", a SELECT without a placeholder, and non-string values (all false).
Verified locally on Ruby 3.4 (
11 tests, 17 assertions, 0 failures— includes #51's tests since this is stacked).Closes #4
🤖 Generated with Claude Code