panates / sqb / 39406427540

95%

master: 96%

Pull #113

github

fix(migrator): scan scripts for non-transactional statements in linear time

The check for statements that cannot run inside a transaction block
scrubbed comments, literals and dollar-quoted bodies with regular
expressions that backtrack polynomially on adversarial input (CodeQL
js/polynomial-redos, three high alerts on the pull request). Replace them
with a one-pass scanner, `splitSqlStatements()`, and match each pattern
against one whole statement from its start.

Matching whole statements also drops two false positives: a column or
object named `vacuum`, or `create database` appearing mid-statement, no
longer fail a run; and `END` is no longer taken for transaction control,
since it also closes a SQLite trigger body or a PostgreSQL `BEGIN ATOMIC`
function body.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2700 of 3200 branches covered (84.38%)

429 of 483 new or added lines in 8 files covered. (88.82%)

20216 of 21396 relevant lines covered (94.48%)

237.79 hits per line