jdaugherty commented on code in PR #16631: URL: https://github.com/apache/grails-core/pull/16631#discussion_r4388383705
########## grails-datamapping-core/src/main/groovy/org/apache/grails/datamapping/core/querytail/CypherSyntax.groovy: ########## @@ -0,0 +1,110 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.grails.datamapping.core.querytail + +import groovy.transform.CompileStatic +import groovy.transform.PackageScope + +/** + * Cypher, the query language of Neo4j: single and double quotes delimit a string, in which a + * backslash escapes the character after it and a quote written twice is two strings; backticks + * delimit a name, in which a backtick is written twice; {@code //} starts a line comment, and + * {@code --} and {@code #} do not, as {@code -->} draws a relationship; block comments do not nest; + * and a dollar starts a parameter. Neo4j 5 ends a line comment at a carriage return, which Neo4j 3.5 + * does not, so a statement with a carriage return that no line feed follows is read both ways. Neo4j 5 + * decodes a {@code \u} escape before it parses, where 3.5 reads it only inside a string, so a + * backslash outside a string or a comment, which may spell a quote, withholds the statement. + */ +@CompileStatic +@PackageScope +final class CypherSyntax extends StandardSqlSyntax { + + private static final char BACKSLASH = '\\' + private static final char QUOTE = '\'' + private static final char DOUBLE_QUOTE = '"' + private static final char BACKTICK = '`' + + private final boolean carriageReturnEndsLine + + CypherSyntax(boolean carriageReturnEndsLine) { + super('Cypher') + this.carriageReturnEndsLine = carriageReturnEndsLine + } + + @Override + List<QueryTailSyntax> readings(String sql) { + if (!hasLoneCarriageReturn(sql)) { + return List.<QueryTailSyntax>of(this) + } + List.<QueryTailSyntax>of(new CypherSyntax(false), new CypherSyntax(true)) + } + + @Override + int endOfComment(String sql, int index) { + if (sql.startsWith('//', index)) { + return endOfLine(sql, index) + } + if (sql.startsWith('/*', index)) { + return endOfBlockComment(sql, index) + } + NONE + } + + @Override + int endOfValue(String sql, int index) { + char c = sql.charAt(index) + if (c == BACKSLASH) { + return UNTERMINATED + } + if (c == QUOTE || c == DOUBLE_QUOTE) { Review Comment: Fixed in d8f76c42e3. Neo4j 5 decodes a `\u` escape that no backslash escapes before it lexes. Its Cypher 5 parser (`CypherCharStream`) and its Cypher 25 parser (`UnicodeEscapeReplacementReader`) both do this. So an escape in a string or a comment can end it somewhere other than where 3.5 and the redactor end it. Such an escape now withholds the statement. An escaped backslash before a `u` (`'C:\\users'`) is not an escape and is still redacted to `?`. Your statement is now asserted withheld, with `secret` absent from the file. That is checked at three levels: - `QueryTailRedactorSpec`: withheld rows, plus the never-survives list. - `QueryTailCaptureSpec`: the capture file. - `QueryTailDriverSpec`: through the real driver on the embedded server. The new rows also cover `\uu0022`, an escape after an escaped backslash, and escapes in `//` and `/* */` comments. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
