validateQueryANTLR validates the SQL statement for SQL editor using omni parser. Returns (isReadOnly, allQueriesReturnData, error) Validation rules: 1. Allow: SELECT statements 2. Allow: EXPLAIN statements (but not EXPLAIN ANALYZE for non-SELECT) 3. Allow: SHOW/SET statements (SET is considered exe
(statement string)
| 19 | // reject a SELECT with a data-modifying CTE term — a fail-safe whitelist. |
| 20 | // 5. Reject: SELECT ... INTO (creates a table) and all other statements (DDL, DML). |
| 21 | func validateQueryANTLR(statement string) (bool, bool, error) { |
| 22 | stmts, err := ParsePg(statement) |
| 23 | if err != nil { |
| 24 | if syntaxErr, ok := err.(*base.SyntaxError); ok { |
| 25 | return false, false, syntaxErr |
| 26 | } |
| 27 | return false, false, err |
| 28 | } |
| 29 | |
| 30 | var hasExecute bool |
| 31 | |
| 32 | for _, stmt := range stmts { |
| 33 | if stmt.AST == nil { |
| 34 | continue |
| 35 | } |
| 36 | |
| 37 | switch n := stmt.AST.(type) { |
| 38 | case *ast.SelectStmt: |
| 39 | // SELECT is read-only unless it writes: SELECT ... INTO creates a table, |
| 40 | // or a data-modifying CTE smuggles a write into the read path. |
| 41 | if isWriteSelect(n) { |
| 42 | return false, false, nil |
| 43 | } |
| 44 | |
| 45 | case *ast.ExplainStmt: |
| 46 | if isExplainAnalyze(n) { |
| 47 | // EXPLAIN ANALYZE executes the query, so it must be a read-only SELECT. |
| 48 | sel, ok := n.Query.(*ast.SelectStmt) |
| 49 | if !ok || isWriteSelect(sel) { |
| 50 | return false, false, nil |
| 51 | } |
| 52 | } |
| 53 | |
| 54 | case *ast.VariableSetStmt: |
| 55 | hasExecute = true |
| 56 | |
| 57 | case *ast.VariableShowStmt: |
| 58 | // SHOW is allowed |
| 59 | |
| 60 | default: |
| 61 | // All other statements (DDL, DML) are not allowed |
| 62 | return false, false, nil |
| 63 | } |
| 64 | } |
| 65 | |
| 66 | return true, !hasExecute, nil |
| 67 | } |
| 68 | |
| 69 | // isExplainAnalyze checks if an ExplainStmt has the ANALYZE option. |
| 70 | func isExplainAnalyze(n *ast.ExplainStmt) bool { |