Skip to content

fix(dev-env): avoid false use matches in SQL imports#2863

Merged
sjinks merged 1 commit into
trunkfrom
pltfrm-2430-potential-false-positive-string-match-during-dev-env-sql
Jun 3, 2026
Merged

fix(dev-env): avoid false use matches in SQL imports#2863
sjinks merged 1 commit into
trunkfrom
pltfrm-2430-potential-false-positive-string-match-during-dev-env-sql

Conversation

@sjinks
Copy link
Copy Markdown
Member

@sjinks sjinks commented May 30, 2026

Description

Fixes a false positive in dev-env SQL validation where UTF-8 bytes for U+2028 inside SQL data could be decoded as line separators. When the following string content started with Use , the existing USE statement check saw a synthetic line and rejected the import.

The validator now reads SQL input with binary line decoding and waits for the reader close event before post-validation summaries. Related: PLTFRM-2430.

Changelog Description

Fixed

  • Dev-env: Fixed false positive SQL import validation errors for exported dumps containing Unicode line-separator bytes inside string data.

Pull request checklist

New release checklist

Steps to Test

  1. Check out this PR.
  2. Run npm run jest -- --runTestsByPath __tests__/lib/validations/sql.js.
  3. Confirm the SQL validation suite passes, including the regression coverage for raw E2 80 A8 bytes followed by Use Cases inside an INSERT value.

## Purpose and Context

Dev-env SQL validation could treat UTF-8 line-separator bytes inside
SQL data as a JavaScript line break. When the following text began with
`Use `, the existing `USE` statement check reported a false positive
for an exported dump that did not contain a real database selection
statement.

Refs PLTFRM-2430.

## Key Changes

- Read validation input with binary line decoding so U+2028 bytes inside
  SQL values do not create synthetic validation lines.
- Wait for the read interface to close before running SQL
  post-validation summaries.
- Add a regression test covering raw `E2 80 A8` bytes followed by
  `Use Cases` inside an INSERT value.

## Impact and Considerations

Real standalone `USE ...` statements remain rejected by the dev-env SQL
validation checks. The change keeps validation local to the existing
reader and SQL validation paths.

## Testing and Validation

Added SQL validation regression coverage for the U+2028 false-positive
case and preserved the existing standalone `USE` rejection coverage.

Ran `npm run jest -- --runTestsByPath __tests__/lib/validations/sql.js`.

Pre-commit evidence already completed:
- Targeted Jest passed fresh: 1 suite, 17 tests.
- adversary-agent verdict CLEAN, no findings.
- contextual review no issues.
- independent review no confirmed bugs; integrator reconciled non-blocking partial-status due separate staged-diff evidence.
Copilot AI review requested due to automatic review settings May 30, 2026 18:41
@github-actions
Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@sonarqubecloud
Copy link
Copy Markdown

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a false‑positive in dev‑env SQL import validation where UTF‑8 bytes for U+2028 (E2 80 A8) inside string data were decoded by Node's readline as line separators, causing the next characters (e.g. Use Cases…) to be treated as a new line that triggered the ^USE check. The fix switches the shared line reader to FileHandle.readLines({ encoding: 'binary' }), so only \n/\r\n split lines and the embedded U+2028 bytes remain inside the value. It also simplifies the close‑awaiting with once(readInterface, 'close').

Changes:

  • Replace createReadStream + readline.createInterface with FileHandle.readLines({ encoding: 'binary' }) in getReadInterface.
  • Use await once(readInterface, 'close') in both fileLineValidations and validate instead of the manual promise+close pattern.
  • Add a regression test that writes raw E2 80 A8 bytes inside an INSERT value followed by Use Cases and asserts no USE <DATABASE_NAME> error.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
src/lib/validations/line-by-line.ts Switches reader to binary readLines() so U+2028/U+2029 bytes are not treated as line breaks; uses once() for close.
src/lib/validations/sql.ts Uses once(readInterface, 'close') to await stream completion.
tests/lib/validations/sql.js Adds regression test verifying dev‑env validation does not flag text following raw U+2028 bytes as a USE statement.

@sjinks sjinks self-assigned this May 30, 2026
@sjinks sjinks requested a review from a team May 30, 2026 18:49
@sjinks sjinks merged commit 43ca700 into trunk Jun 3, 2026
20 checks passed
@sjinks sjinks deleted the pltfrm-2430-potential-false-positive-string-match-during-dev-env-sql branch June 3, 2026 17:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants