fix(parse): check JOIN ON inside UPDATE FROM and DELETE USING - #348
Merged
Conversation
StrictRow<DB, 'update users set name = $1 from orders o join refunds r on r.nope = o.id where users.id = o.user_id'>
// was Record<string, never> - r.nope accepted silently
The joined sources were registered - returning `r.id` from the valid variant
worked - so only the ON expressions went unchecked. Both write branches
hardcoded `fromText: ''`, so ApplyWhereCheck's ExtractJoinOnText never saw
their join text. The README says strict mode checks JOIN ... ON conditions
and makes no carve-out for write statements.
Both now pass the real FROM/USING clause text, taken with the same
TakeFromClause a SELECT uses, and kept as raw text for the same reason: the
scan only runs in strict mode.
Fixes #281
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
tiagolauer
force-pushed
the
fix/281-dml-join-on
branch
from
August 2, 2026 13:04
7e66892 to
89fd55a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #281.
The bug
Same with
delete from users using orders o join refunds r on r.nope = o.id .... The joined sources themselves are registered — returningr.idfrom the valid variant works — so it is only the ON expressions that go unchecked. The README says strict mode checksJOIN ... ONconditions and makes no carve-out for write statements.The fix
The UPDATE and DELETE branches hardcoded
fromText: '', soApplyWhereCheck'sExtractJoinOnTextnever saw their join text.Both now pass the real FROM/USING clause text, taken with the same
TakeFromClausea SELECT uses, and kept as raw text for the same reason the SELECT branch documents: the JOIN ON scan only runs in strict mode.Verification
tests/dml-join-on-strict.test-d.ts, eight cases. Three red on master:UPDATE ... FROMand of aDELETE ... USINGUPDATE ... FROMControls: the valid versions of both statements still pass, an UPDATE without a FROM is unchanged,
UPDATE ... FROM ... RETURNINGstill types its row, and loose mode still reports nothing.tsc --noEmitclean, 192 runtime tests pass, budget 192,596 (+110).