Spaces:
Running
Running
File size: 11,188 Bytes
e68a95d a6a4880 e68a95d cf85b28 e68a95d | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 | from __future__ import annotations
import re
from enum import Enum
from typing import Any, Optional
import sqlglot
from sqlglot import exp
from sqlglot.errors import ParseError
class QueryType(str, Enum):
SELECT = "SELECT"
INSERT = "INSERT"
UPDATE = "UPDATE"
DELETE = "DELETE"
CREATE = "CREATE"
ALTER = "ALTER"
DROP = "DROP"
TRUNCATE = "TRUNCATE"
MERGE = "MERGE"
WITH = "WITH"
CALL = "CALL"
EXPLAIN = "EXPLAIN"
UNKNOWN = "UNKNOWN"
_DIALECT_ALIASES: dict[str, Optional[str]] = {
"mysql": "mysql",
"mariadb": "mysql",
"postgres": "postgres",
"postgresql": "postgres",
"pg": "postgres",
"redshift": "redshift",
"cockroachdb": "cockroachdb",
"cockroach": "cockroachdb",
"crdb": "cockroachdb",
"sqlite": "sqlite",
"sqlserver": "tsql",
"mssql": "tsql",
"tsql": "tsql",
"oracle": "oracle",
"oracledb": "oracle",
"bigquery": "bigquery",
"gcp": "bigquery",
"bq": "bigquery",
"snowflake": "snowflake",
"sf": "snowflake",
"spark": "spark",
"hive": "hive",
"databricks": "databricks",
"duckdb": "duckdb",
"presto": "presto",
"trino": "trino",
"clickhouse": "clickhouse",
"ansi": None,
"standard": None,
"sql": None,
}
_READ_ONLY_TYPES: frozenset[QueryType] = frozenset(
{QueryType.SELECT, QueryType.WITH, QueryType.EXPLAIN}
)
_AST_TYPE_MAP: list[tuple[type[exp.Expression], QueryType]] = [
(exp.Select, QueryType.SELECT),
(exp.Union, QueryType.SELECT),
(exp.Intersect, QueryType.SELECT),
(exp.Except, QueryType.SELECT),
(exp.Insert, QueryType.INSERT),
(exp.Update, QueryType.UPDATE),
(exp.Delete, QueryType.DELETE),
(exp.Create, QueryType.CREATE),
(exp.Alter, QueryType.ALTER),
(exp.AlterColumn, QueryType.ALTER),
(exp.Drop, QueryType.DROP),
(exp.TruncateTable, QueryType.TRUNCATE),
(exp.Merge, QueryType.MERGE),
(exp.With, QueryType.WITH),
(exp.Command, QueryType.UNKNOWN),
]
_WRITE_NODE_TYPES: tuple[type[exp.Expression], ...] = (
exp.Insert,
exp.Update,
exp.Delete,
exp.Create,
exp.Alter,
exp.AlterColumn,
exp.Drop,
exp.TruncateTable,
exp.Merge,
)
_PLACEHOLDER_PATTERNS: list[tuple[str, re.Pattern[str]]] = [
("positional_?", re.compile(r"\?")),
("pyformat_%s", re.compile(r"%s")),
("numeric_$n", re.compile(r"\$\d+")),
("named_:param", re.compile(r"(?<![:\w]):(\w+)")),
]
def _normalize_dialect(dialect: Optional[str]) -> Optional[str]:
if dialect is None:
return None
key = dialect.strip().lower()
return _DIALECT_ALIASES.get(key, key)
def _has_ctes(statement: exp.Expression) -> bool:
return statement.args.get("with") is not None
def _detect_query_type(statement: exp.Expression) -> QueryType:
if _has_ctes(statement):
return QueryType.WITH
for ast_type, query_type in _AST_TYPE_MAP:
if isinstance(statement, ast_type):
return query_type
type_name = type(statement).__name__.upper()
for qt in QueryType:
if qt != QueryType.UNKNOWN and qt.value in type_name:
return qt
return QueryType.UNKNOWN
def _is_read_only(statement: exp.Expression, query_type: QueryType) -> bool:
if query_type in _READ_ONLY_TYPES and query_type != QueryType.WITH:
return True
if query_type not in _READ_ONLY_TYPES:
return False
if query_type == QueryType.WITH:
for node in statement.find_all(_WRITE_NODE_TYPES):
return False
return True
return False
def _extract_tables(statement: exp.Expression) -> list[str]:
tables: list[str] = []
seen: set[str] = set()
for tbl in statement.find_all(exp.Table):
parts: list[str] = []
if tbl.catalog:
parts.append(tbl.catalog)
if tbl.db:
parts.append(tbl.db)
parts.append(tbl.name)
full_name = ".".join(p for p in parts if p)
if full_name and full_name not in seen:
seen.add(full_name)
tables.append(full_name)
return tables
def _extract_columns(statement: exp.Expression) -> list[str]:
columns: list[str] = []
seen: set[str] = set()
for col in statement.find_all(exp.Column):
name = col.name
if name and name not in seen:
seen.add(name)
columns.append(name)
return columns
def _detect_placeholders(query: str) -> list[str]:
stripped = re.sub(r"'(?:[^'\\]|\\.)*'", "", query)
stripped = re.sub(r'"(?:[^"\\]|\\.)*"', "", stripped)
detected: set[str] = set()
for name, pattern in _PLACEHOLDER_PATTERNS:
if pattern.search(stripped):
detected.add(name)
if detected:
return [
f"Prepared-statement placeholders detected: "
f"{', '.join(sorted(detected))}. Ensure the target "
f"database driver supports these placeholder styles."
]
return []
def _check_best_practices(statement: exp.Expression) -> list[str]:
warnings: list[str] = []
for sel in statement.find_all(exp.Select):
if any(isinstance(e, exp.Star) for e in (sel.expressions or [])):
warnings.append(
"SELECT * detected — explicitly listing columns is "
"recommended for performance and maintainability."
)
break
if isinstance(statement, exp.Update) and not statement.args.get("where"):
warnings.append(
"UPDATE without a WHERE clause will affect every row in the table."
)
if isinstance(statement, exp.Delete) and not statement.args.get("where"):
warnings.append(
"DELETE without a WHERE clause will remove every row from the table."
)
for join in statement.find_all(exp.Join):
kind = (join.args.get("kind") or "").upper()
method = (join.args.get("method") or "").upper()
if kind == "NATURAL" or method == "NATURAL":
warnings.append(
"NATURAL JOIN can produce unexpected column matches — "
"prefer explicit JOIN conditions."
)
break
return warnings
def _analyze_statements(statements: list[exp.Expression]) -> dict[str, Any]:
all_tables: list[str] = []
tables_seen: set[str] = set()
all_columns: list[str] = []
columns_seen: set[str] = set()
all_warnings: list[str] = []
primary_type: QueryType = QueryType.UNKNOWN
is_read_only = True
for idx, stmt in enumerate(statements):
stmt_type = _detect_query_type(stmt)
if idx == 0:
primary_type = stmt_type
if not _is_read_only(stmt, stmt_type):
is_read_only = False
for t in _extract_tables(stmt):
if t not in tables_seen:
tables_seen.add(t)
all_tables.append(t)
for c in _extract_columns(stmt):
if c not in columns_seen:
columns_seen.add(c)
all_columns.append(c)
all_warnings.extend(_check_best_practices(stmt))
if isinstance(stmt, exp.Command):
cmd_verb = getattr(stmt, "name", "")
all_warnings.append(
f"Statement uses a {cmd_verb!r} command that could not be "
f"fully analysed. Syntax validation may be incomplete."
)
if len(statements) > 1:
all_warnings.append(
f"Multiple statements detected ({len(statements)} total). "
f"Results reflect the combined analysis of all statements."
)
return {
"query_type": primary_type.value,
"is_read_only": is_read_only,
"tables": all_tables,
"columns": all_columns,
"warnings": all_warnings,
}
class SqlValidatorService:
def validate(self, query: str, dialect: Optional[str] = None) -> dict[str, Any]:
if not isinstance(query, str):
raise TypeError(f"query must be a string, got {type(query).__name__}")
if dialect is not None and not isinstance(dialect, str):
raise TypeError(f"dialect must be a string or None, got {type(dialect).__name__}")
normalized_dialect = _normalize_dialect(dialect)
stripped_query = query.strip()
if not stripped_query:
return {
"valid": False,
"query_type": QueryType.UNKNOWN.value,
"dialect": normalized_dialect,
"errors": ["Empty query string provided."],
"warnings": [],
"is_read_only": False,
"tables": [],
"columns": [],
}
warnings: list[str] = _detect_placeholders(stripped_query)
statements: list[exp.Expression] = []
errors: list[str] = []
try:
parsed = sqlglot.parse(
stripped_query,
dialect=normalized_dialect,
error_level=sqlglot.ErrorLevel.RAISE,
)
statements = [s for s in parsed if s is not None]
except ParseError as exc:
errors.append(f"SQL syntax error: {exc}")
except RecursionError:
errors.append("Query is too deeply nested to parse — consider simplifying.")
except Exception as exc:
errors.append(f"Unexpected error during parsing: {exc}")
if errors:
try:
parsed = sqlglot.parse(
stripped_query,
dialect=normalized_dialect,
error_level=sqlglot.ErrorLevel.WARN,
)
statements = [s for s in parsed if s is not None]
except Exception:
statements = []
if not statements:
if not errors:
errors.append("No valid SQL statements found. The query may be empty or contain only comments.")
return {
"valid": False,
"query_type": QueryType.UNKNOWN.value,
"dialect": normalized_dialect,
"errors": errors,
"warnings": warnings,
"is_read_only": False,
"tables": [],
"columns": [],
}
analysis = _analyze_statements(statements)
warnings.extend(analysis["warnings"])
valid = len(errors) == 0
if valid and analysis["query_type"] == QueryType.UNKNOWN.value:
has_known_statement = any(
_detect_query_type(s) != QueryType.UNKNOWN for s in statements
)
if not has_known_statement:
valid = False
if not errors:
errors.append(
"Query could not be recognised as a valid SQL statement."
)
return {
"valid": valid,
"query_type": analysis["query_type"],
"dialect": normalized_dialect,
"errors": errors,
"warnings": warnings,
"is_read_only": analysis["is_read_only"],
"tables": analysis["tables"],
"columns": analysis["columns"],
}
|