MSSQL spike: scaffold spike directory and must-reject corpus #313

New issue

Closed

opened 2026-11-10 08:17:52 +00:00 by david · 1 comment

david commented

2026-11-10 08:17:52 +00:00

Owner

Summary

Create extensions/mssql/spike/ and a labelled corpus of SQL that the read-only guard must reject.

Background

The MSSQL extension's only write block is a T-SQL parser allowlist. The spike scores two parser candidates against two corpora; this step builds the must-reject corpus. The corpus is stored as data (one case per entry, with a label) so it becomes a permanent test later. No package.json registration and no tools in this stage.

Depends on: #312

Implementation Details

Create extensions/mssql/spike/corpus-reject.json (or .mjs exporting an array), each entry { "label": "...", "sql": "..." }. Cover at least: UPDATE, INSERT, DELETE, MERGE, DROP, TRUNCATE, ALTER, CREATE, SELECT ... INTO, EXEC/EXECUTE (including EXEC('...') and EXEC sp_...), OPENROWSET, OPENQUERY, OPENDATASOURCE, stacked statements (SELECT 1; DROP TABLE x), comment tricks (--, /* */, nested /* /* */ */, a write hidden after a comment, a ; hidden by a comment), a CTE whose body contains a write (WITH x AS (...) DELETE ..., WITH x AS (...) UPDATE ...), xp_cmdshell, WAITFOR, BULK INSERT, USE, GO batches, and variable/SET statements. Add any other cases you can find (mixed case, unicode whitespace, unusual line breaks, bracketed-identifier tricks). Each label must say what the case tests. Do not add parser code here.

Acceptance Criteria

extensions/mssql/spike/ exists with the reject corpus as data.
Every entry has a unique non-empty label and an sql string.
All categories listed above are represented, with at least 40 entries in total.
Comment-trick and CTE-with-write cases are included.
The file loads without error (node -e "import('./extensions/mssql/spike/corpus-reject.mjs')" or JSON parse).

Test Plan

Load the file in Node and print the entry count and the set of labels; confirm no duplicates and every category above appears.

## Summary Create `extensions/mssql/spike/` and a labelled corpus of SQL that the read-only guard must reject. ## Background The MSSQL extension's only write block is a T-SQL parser allowlist. The spike scores two parser candidates against two corpora; this step builds the must-reject corpus. The corpus is stored as data (one case per entry, with a label) so it becomes a permanent test later. No `package.json` registration and no tools in this stage. **Depends on:** #312 ## Implementation Details Create `extensions/mssql/spike/corpus-reject.json` (or `.mjs` exporting an array), each entry `{ "label": "...", "sql": "..." }`. Cover at least: `UPDATE`, `INSERT`, `DELETE`, `MERGE`, `DROP`, `TRUNCATE`, `ALTER`, `CREATE`, `SELECT ... INTO`, `EXEC`/`EXECUTE` (including `EXEC('...')` and `EXEC sp_...`), `OPENROWSET`, `OPENQUERY`, `OPENDATASOURCE`, stacked statements (`SELECT 1; DROP TABLE x`), comment tricks (`--`, `/* */`, nested `/* /* */ */`, a write hidden after a comment, a `;` hidden by a comment), a CTE whose body contains a write (`WITH x AS (...) DELETE ...`, `WITH x AS (...) UPDATE ...`), `xp_cmdshell`, `WAITFOR`, `BULK INSERT`, `USE`, `GO` batches, and variable/`SET` statements. Add any other cases you can find (mixed case, unicode whitespace, unusual line breaks, bracketed-identifier tricks). Each label must say what the case tests. Do not add parser code here. ## Acceptance Criteria - [ ] `extensions/mssql/spike/` exists with the reject corpus as data. - [ ] Every entry has a unique non-empty `label` and an `sql` string. - [ ] All categories listed above are represented, with at least 40 entries in total. - [ ] Comment-trick and CTE-with-write cases are included. - [ ] The file loads without error (`node -e "import('./extensions/mssql/spike/corpus-reject.mjs')"` or JSON parse). ## Test Plan Load the file in Node and print the entry count and the set of labels; confirm no duplicates and every category above appears.

david added this to the MSSQL: M2 - Spike corpora and candidates milestone

2026-11-10 08:17:52 +00:00

david added the

feature

label

2026-11-10 08:17:52 +00:00

david referenced this issue

2026-11-10 08:18:06 +00:00

MSSQL spike: must-accept corpus #314

david referenced this issue

2026-11-10 22:26:34 +00:00

313: MSSQL spike: scaffold spike directory and must-reject corpus #335