googleapis / googleapis/go-sql-spanner

Statement Parser silently consumes unterminated multi-line comments

Open
#840 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
125
Forks
35
Avg merge
2h 20m
Merged PRs (30d)
4

Description

# Bug: Statement Parser silently consumes unterminated multi-line comments to EOF

### Description
The client-side statement parser in the `go-sql-spanner` driver silently consumes unterminated multi-line comments (`/* ...` without a matching `*/`) to the end of the query string (EOF) without returning a parsing/syntax error.

This is a bug because standard SQL dialects (including GoogleSQL and PostgreSQL) treat unterminated comments as syntax errors.

### Impact / Reproduction Case
Because the comment silently swallows the rest of the query, it can mask syntax errors that appear after the comment block.

For example, in the PostgreSQL dialect, the statement:
`show variable /*should have been a comment* my_property`

Should be a syntax error for two reasons:
1. The comment `/*should have been a comment*` is never terminated.
2. The `variable` keyword is not supported under the PostgreSQL dialect (which only expects `SHOW `), and `my_property` should be considered unexpected trailing tokens.

However, the driver's statement parser currently parses this successfully as:
* Command: `SHOW`
* Identifier: `variable`
* Trailing tokens: none (since they were swallowed by the unterminated comment).

### Code Location
The behavior is located in [statement_parser.go](file:///Users/loite/GolandProjects/go-sql-spanner/parser/statement_parser.go#L406-L432) inside the `skipMultiLineComment` method:
```go
func (p *StatementParser) skipMultiLineComment(sql []byte, pos int) int {
// Skip '/*'.
pos = pos + 2
level := 1
for pos < len(sql) {
...
}
return pos // Returns len(sql) without returning a tokenization error if '*/' is not found.
}
```

### Suggested Fix
Update the tokenizer/parser methods (such as `skip` and `skipMultiLineComment`) to return an error if a comment starts with `/*` but is not closed before reaching the end of the string.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.