Method executeReadOnly

src/connectors/sqlserver/index.ts:718–802

* Execute a query inside a transaction that always rolls back, preventing * any modifications from persisting. SQL Server has no native READ ONLY * transaction mode, so this is the defense-in-depth backstop behind the * keyword classifier. * * Because the rollback guard is application

(
    processedSQL: string,
    parameters?: any[],
  )

   *   COMMIT/ROLLBACK inside string literals that stripCommentsAndStrings removes
   */
  private async executeReadOnly(
    processedSQL: string,
    parameters?: any[],
  ): Promise<SQLResult> {
    const cleaned = stripCommentsAndStrings(processedSQL, "sqlserver").toLowerCase();
    if (/\b(?:commit|rollback)\b/.test(cleaned)) {
      throw new Error(
        "Read-only mode: transaction control statements (COMMIT, ROLLBACK) are not allowed",
      );
    }
    if (/\b(?:exec|execute|sp_executesql|xp_cmdshell)\b/.test(cleaned)) {
      throw new Error(
        "Read-only mode: dynamic SQL execution (EXEC, EXECUTE, sp_executesql, xp_cmdshell) is not allowed",
      );
    }

    const transaction = new sql.Transaction(this.connection!);
    await transaction.begin();

    const request = new sql.Request(transaction);
    const messages: DatabaseMessage[] = [];
    request.on(
      'info',
      (info: { message: string; number?: number; class?: number; lineNumber?: number }) => {
        messages.push({
          text: info.message,
          severity: info.class !== undefined ? String(info.class) : undefined,
          code: info.number,
          line: info.lineNumber,
        });
      },
    );

    if (parameters && parameters.length > 0) {
      parameters.forEach((param, index) => {
        const paramName = `p${index + 1}`;
        if (typeof param === 'string') {
          request.input(paramName, sql.VarChar, param);
        } else if (typeof param === 'number') {
          if (Number.isInteger(param)) {
            request.input(paramName, sql.Int, param);
          } else {
            request.input(paramName, sql.Float, param);
          }
        } else if (typeof param === 'boolean') {
          request.input(paramName, sql.Bit, param);
        } else if (param === null || param === undefined) {
          request.input(paramName, sql.VarChar, param);
        } else if (Array.isArray(param)) {
          request.input(paramName, sql.VarChar, JSON.stringify(param));
        } else {
          request.input(paramName, sql.VarChar, JSON.stringify(param));
        }
      });
    }

    let result;
    let queryFailed = false;