fix(db): guard every SQLite identifier quoting form in the ILIKE rewrite - #544
Conversation
The rewrite only knew about single and double quotes, so it happily mangled `ILIKE` and [ILIKE] — SQLite accepts both as quoted identifiers. It also treated $ as a word boundary, which split identifiers like foo$ilike. Track the backtick and bracket forms, count $ as part of an identifier, and drop the ToLower copy in the pre-check so statements without the operator no longer allocate on their way to the driver. The comment about the connection only implementing Prepare is now a test instead, since a comment would not have stopped anyone from adding a QueryerContext fast path that skips the rewrite. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FXYnxBszfwkNUeeAcVSSNf
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
trenova | 577d271 | Aug 12 2026, 06:28 PM |
|
Warning Review limit reached
Next review available in: 18 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2 participants
Description
Follow-up to #543, which merged before its review came back.
The ILIKE rewrite only tracked
'and"when deciding what to skip. SQLite alsoaccepts backtick and bracket quoted identifiers, so
`ILIKE`and[ILIKE]werebeing rewritten inside their quotes. It also treated
$as a word boundary, whichsplit identifiers like
foo$ilikeand rewrote the tail.Neither shows up in what Bun's sqlitedialect emits — it quotes with
"— so nothingis broken today. It's a raw query away from mattering, and both are cheap to close.
Two smaller things came along with it:
strings.ToLowerin the pre-check copied every statement before every prepare,including the ones with no
ILIKEin them. Replaced with a byte scan, so the commonpath no longer allocates.
rewriteConnimplements only the prepare path is nowTestRewriteConnHasNoFastPath.database/sqlskipsPreparewhen a conn advertisesQueryerContextorExecerContext, so adding either would quietly route statementsaround the rewrite. A comment wasn't going to stop that; a failing test will. The rest
of the comments in the file are gone, per
CLAUDE.md.Related Issue or Discussion
Follows #543. Part of the SQLite development-database work.
Type of Change
Scope
services/tms/internal/infrastructure/postgres/sqlitedriver.goservices/tms/internal/infrastructure/postgres/sqlitedriver_test.goPostgres is untouched — this file only runs when the driver is SQLite.
Validation
go build ./...— cleango vet ./internal/infrastructure/postgres/— cleango test ./internal/infrastructure/postgres/ -run 'TestRewriteILike|TestSQLiteDriver|TestRewriteConn' -v— 14/14 passgolangci/golines@v0.15.0 --max-len=100 --tab-len=4Four new tests: backtick identifiers, bracket identifiers,
$in identifiers, and theno-fast-path guard.
Deployment Notes
None. Development-only code path, no migrations, no config changes.
Checklist
AGENTS.md,CLAUDE.md, and existing repository patterns.Generated by Claude Code