mrproliu opened a new pull request, #1209: URL: https://github.com/apache/skywalking-banyandb/pull/1209
### Introduce positional parameter binding into BydbQL This PR introduces positional parameter binding (`?` placeholders) into BydbQL so that untrusted values never need to be concatenated into the query string, eliminating QL injection by construction. `bydbql.v1.QueryRequest` gains a `params` field (`repeated model.v1.TagValue`, reusing the existing common value type instead of introducing a new message) whose entries are bound to the `?` placeholders by their order of appearance. **How it works.** Binding is implemented as a standalone AST pass (`pkg/bydbql/binder.go`) that runs between the parser and the transformer: the lexer gains a `?` token, value nodes in the grammar gain a placeholder branch, and `BindParams` fills the placeholders from the request parameters so that a bound AST is indistinguishable from one parsed with literal values — the 1700-line transformer needs zero placeholder awareness. Since a bound parameter is always a value and can never alter the query structure, injection is impossible by design. As defense in depth, `Transform` rejects any grammar that still contains unbound placeholders, and a reflection-based tripwire test guards that every `@Param` position in the grammar is wired into the binder. **Supported positions.** Placeholders are accepted in value positions only: TIME values (`str` relative/RFC3339/`now`, or a typed `timestamp` which is validated at bind time), scalar comparisons (`str`/`int`/`null` for all six operators), IN/NOT IN/MATCH/HAVING value lists (`str`/`int`/`null` plus `str_array`/`int_array` which expand in place while the container keeps its literal single-vs-list form), and LIMIT/OFFSET/TOP N counts (`int` only, range-checked to `[0, MaxInt32]`), matching mainstream SQL prepared-statement conventions. Identifier and structural positions (resource/group/stage names, columns, ORDER BY/GROUP BY, MATCH analyzer) remain syntax errors — unlike some SQL implementations where `ORDER BY ?` silently degrades to a no-op, BydbQL rejects it outright. Binding errors (count mismatch, type mismatch, out-of-range) are reported as `InvalidArgument` with the 1-based position of the offending parameter. **Consumers.** The embedded web UI's BydbQL console gains a parameter input panel (typed rows sent as protojson TagValues), and the error path now surfaces the server's detailed message instead of the bare HTTP status text. The MCP server's `list_resources_bydbql` tool accepts a typed `params` array so LLM-generated queries can pass untrusted values out of band, with the prompt guidance updated accordingly. <img width="2916" height="1314" alt="BydbQL console with parameter binding: a ? placeholder in the query bound from the typed parameter row below the editor" src="https://github.com/user-attachments/assets/6f5efd89-dbba-4e35-a014-2efd65a70511"; /> **Testing.** `pkg/bydbql` grows to 544 specs: a full acceptance matrix (every parameter type x every placeholder path), an equivalence suite asserting that a parameterized query and its literal-valued twin produce byte-identical native query requests through the real transformer (with an `expectError` marker so error cases cannot pass vacuously), parse-time rejection tests for every forbidden position, and injection-payload tests. All six integration test suites (stream/measure/trace/property/topn/tracepipeline) share a new `helpers.ExtractQL` that reads an optional `#!params:` directive from `.ql` files, and each gets an end-to-end `params_bind` case covering a different parameter shape, including `SHOW TOP ?` and `LIMIT ?`. Documentation (`docs/interacting/bydbql.md` §2.6) documents the complete supported/unsupported position tables and type rules. - [x] If this pull request closes/resolves/fixes an existing issue, replace the issue number. Fixes apache/skywalking#13628. - [x] Update the [`CHANGES` log](https://github.com/apache/skywalking-banyandb/blob/main/CHANGES.md). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
