Skip to content

fix: only run nested sub-query for SELECT templates with ${...} (#4) - #52

Merged
y-ken merged 1 commit into
masterfrom
fix/nested-subquery-placeholder
Jun 16, 2026
Merged

fix: only run nested sub-query for SELECT templates with ${...} (#4)#52
y-ken merged 1 commit into
masterfrom
fix/nested-subquery-placeholder

Conversation

@y-ken

@y-ken y-ken commented Jun 16, 2026

Copy link
Copy Markdown
Owner

Summary

Fixes #4: in mysql_replicator (single), a column value that merely begins with "SELECT" triggered an unintended nested sub-query, so ordinary text data could be executed as SQL.

📌 Stacked on #51 . Base is fix/delete-detection-range to keep the diff clean and avoid a conflict in the shared test file; GitHub will retarget this to master once #51 merges.

Background — why #4 was still open

The maintainer proposed the correct fix back in 2014 and #6 applied it — but only to in_mysql_replicator_multi.rb:

file regex
multi (in_mysql_replicator_multi.rb) /^SELECT[^\$]+\$\{[^\}]+\}/i ✅ (fixed in #6)
single (in_mysql_replicator.rb) /^SELECT(\s+)/i ❌ still fires without a placeholder

#4 was reported against the single plugin, which never received the fix. This PR ports the proven multi regex to single so the two behave consistently.

Fix

Require a ${placeholder} before treating a value as a sub-query template, and extract the predicate for testing:

def nested_query_value?(value)
  value.to_s.strip.match?(/^SELECT[^\$]+\$\{[^\}]+\}/i)
end

So "SELECT * FROM child WHERE parent_id = ${id}" still nests, while a data value like "SELECT YOUR PLAN" is left alone.

Tests

Added regression tests: a real template (true), plain text starting with "SELECT", the word "Selecting", a SELECT without a placeholder, and non-string values (all false).

Verified locally on Ruby 3.4 (11 tests, 17 assertions, 0 failures — includes #51's tests since this is stacked).

Closes #4

🤖 Generated with Claude Code

In mysql_replicator (single), any column value beginning with "SELECT"
triggered an unintended nested sub-query, so ordinary text data starting
with the word "SELECT" was executed as SQL.

Require a ${placeholder} before treating a value as a sub-query template,
using the same regex already applied to mysql_replicator_multi in #6
(/^SELECT[^\$]+\$\{[^\}]+\}/i). The single plugin — the file #4 was
reported against — never received that fix; this brings the two in line.

Extract the predicate as nested_query_value? and add regression tests
covering a real template, plain text starting with "SELECT", the word
"Selecting", a SELECT without a placeholder, and non-string values.

Closes #4

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Base automatically changed from fix/delete-detection-range to master June 16, 2026 10:12
@y-ken
y-ken merged commit ca2c4ee into master Jun 16, 2026
9 checks passed
@y-ken
y-ken deleted the fix/nested-subquery-placeholder branch June 16, 2026 10:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Issue with mysql_replicator

1 participant