joaoh82 / rust_sqlite / 27375296580

70%

Build Type

push

github

Committed by web-flow

Commit Message

fix(sql): validate table qualifiers in FTS function column args (SQLR-15) (#168)

fts_match() / bm25_score() extract their column argument syntactically
(they need the column name to find the index, not its value), so the
qualifier never passed through RowScope::lookup and SQLR-14's check.
A bogus qualifier was silently dropped: fts_match(bogus.body, 'q') ran
as fts_match(body, 'q').

Add RowScope::scope_name() (Some(name) for single-table scope, None for
joined / group-row scopes) and run check_single_scope_qualifier in
resolve_fts_args when the column arg is a CompoundIdentifier. Error
wording matches SQLR-14. 3+-part identifiers now error like the main
evaluator instead of being silently truncated.

Audited the other syntactic extraction sites: JSON and vec_distance
helpers evaluate args through eval_expr_scope (already covered);
pager catalog re-parses are trusted engine-written SQL.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

39 of 47 new or added lines in 2 files covered. (82.98%)

1 existing line in 1 file now uncovered.

11913 of 17089 relevant lines covered (69.71%)

1.26 hits per line