albertZhangTJ / sqlancer-lancerfuzz

SQLancer, with grammar-based fuzzing capability
http://www.sqlancer.com/
MIT License
1 stars 0 forks source link

Reserve something for list of identifiers instead of one node for each identifier #11

Closed albertZhangTJ closed 10 months ago

albertZhangTJ commented 11 months ago

Instead of the current "get-what-you-described" way for defining a list of identifiers, or more concretely something like this

column_list : column_name ( ',' column_name)* ;
column_name locals [boolean is_schema=true, String query="stub", String attribute_name="name"] : STUB;

We can instead define a list of identifiers as a single grammar rule, in something like this

calling_column_list : column_list[boolean is_new=false, boolean is_list=true, String rp_id="a", int rp_limit_h=5, int rp_limit_l=2, String sub=null, String sup=null]; 
column_list locals [boolean is_schema=true, String delimiter=",", String query="stub", String attribute_name="name"] : STUB;

And we can reuse the current slot for iid (iid is the ID for used identifiers list) for rp_id to pass the number of repetitions to the node at runtime to control the number of columns generated.

Since in this case the schema node also does some work of the quantifier node, it needs access to repetition ID (same stuff as RP_ID defined in quantifier node, repetition lower and upper limit.

This shall eliminate the need for Used Identifiers List since all the identifiers in this list are now generated in the same node in the AST.

albertZhangTJ commented 11 months ago

@mrigger Hi prof, above is a description of the idea mentioned today. I'll try to implement this within today (should be easy).

albertZhangTJ commented 11 months ago

I started to wonder if this is a good idea since we are blurring the boundary between quantifier nodes and we need to access the same thing at in different ways (passing rp_id as part of parameter list when calling schema node VS. referencing IP_ID() function in ANTLR Action within quantifier nodes), which might be confusing to the user.

albertZhangTJ commented 11 months ago

Since it will be even messier to adapt both methods within the same program, probably I shall open a new branch for this new implementation.

albertZhangTJ commented 10 months ago

Implemented in DSQLancer-schema-list branch, but decided to be probably a bad idea. Will close for now.