Function validateWhere

packages/core/src/scripts/db/patch.ts:109–140

Reject WHERE clauses that could chain statements or hide DDL. This isn't * a full SQL parser — just a keyword/character denylist to keep the surface * area equivalent to what db-exec already allows.

(where: string)

 *  a full SQL parser — just a keyword/character denylist to keep the surface
 *  area equivalent to what db-exec already allows. */
function validateWhere(where: string): void {
  if (where.includes(";")) {
    fail("--where must not contain ';' (no statement chaining)");
  }
  // Strip inline strings before keyword scanning so "WHERE name = 'DROP TABLE'"
  // doesn't trip the denylist.
  const stripped = where
    .replace(/'(?:''|[^'])*'/g, "''")
    .replace(/"(?:""|[^"])*"/g, '""')
    .toUpperCase();

  const blocked = [
    " INSERT ",
    " UPDATE ",
    " DELETE ",
    " DROP ",
    " ALTER ",
    " CREATE ",
    " ATTACH ",
    " DETACH ",
    " PRAGMA ",
    " VACUUM ",
    "--",
    "/*",
  ];
  const padded = " " + stripped + " ";
  for (const kw of blocked) {
    if (padded.includes(kw)) {
      fail(`--where must not contain "${kw.trim()}"`);
    }
  }
}

function parseEdits(parsed: Record<string, string>): TextEdit[] {
  let edits: TextEdit[];