Function checkSqlExecutionGuards

backend/src/utils/sql-parser.ts:129–177

(query: string)

}

export function checkSqlExecutionGuards(query: string): string | null {
  const rawTextError = getRawTextGuardError(query);
  if (rawTextError) {
    return rawTextError;
  }

  try {
    const { stmts } = parseSync(query);

    for (const stmtWrapper of stmts) {
      const stmt = stmtWrapper.stmt as Record<string, unknown>;
      const [stmtType, data] = Object.entries(stmt)[0] as [string, Record<string, unknown>];

      if (DATABASE_MANAGEMENT_STATEMENTS.has(stmtType)) {
        return 'Query contains restricted operations';
      }

      if (stmtType === 'VariableSetStmt') {
        if (data.kind === 'VAR_RESET_ALL') {
          return 'RESET ALL is not allowed.';
        }

        const name = ((data.name as string | undefined) ?? '').toLowerCase();
        if (EXECUTION_CONTEXT_VARIABLES.has(name)) {
          return 'Changing SQL execution role or session authorization is not allowed.';
        }
        if (name === SEARCH_PATH_VARIABLE) {
          return 'Changing SQL search_path is not allowed.';
        }
        if (name === STATEMENT_TIMEOUT_VARIABLE) {
          return 'Changing SQL statement_timeout is not allowed.';
        }
      }

      if (ROLE_MANAGEMENT_STATEMENTS.has(stmtType)) {
        return 'Managing database roles is not allowed.';
      }

      if (stmtType === 'TransactionStmt') {
        return 'Transaction control statements are not allowed.';
      }
    }

    return null;
  } catch (parseError) {
    logger.warn('SQL parse error in checkSqlExecutionGuards, rejecting query:', parseError);
    return 'Query could not be parsed and was rejected for security reasons.';
  }
}

/**
 * Parse a SQL string into individual statements, properly handling: