Fix: detect mutating keywords inside CTEs in read-only mode (#275) * Fix: detect mutating keywords inside CTEs in read-only mode The read-only SQL check only examined the first keyword, so queries like `WITH updated AS (UPDATE ...) SELECT ...` bypassed the restriction. Now scans the full statement (after stripping comments and strings) for DML/DDL keywords. Closes #271 Co-Authored-By: Claude Opus 4.6 * Fix: exclude REPLACE() string function from mutating keyword detection REPLACE followed by ( is a string function call (e.g. SELECT REPLACE(...)), not a mutating REPLACE INTO statement. Use negative lookahead to avoid false positives. Co-Authored-By: Claude Opus 4.6 * Fix: scope mutating scan to WITH statements, add SELECT INTO detection - Only scan for mutating keywords when first keyword is WITH (fixes false rejection of SHOW CREATE TABLE in MySQL/MariaDB) - Add SELECT ... INTO detection for Postgres/MySQL/SQL Server - EXPLAIN with DML is allowed since it doesn't execute the statement - Add 6 more tests for SHOW CREATE, EXPLAIN, and SELECT INTO Co-Authored-By: Claude Opus 4.6 * Fix: handle WITH...SELECT INTO, EXPLAIN ANALYZE with DML, REPLACE() in CTEs - WITH statements now also check for SELECT ... INTO - EXPLAIN ANALYZE with DML is rejected (Postgres executes the statement) - EXPLAIN without ANALYZE remains allowed with DML (plan only) - Fixed regex word boundary for parenthesized EXPLAIN (ANALYZE) form - Added tests for REPLACE() inside CTEs, WITH...SELECT INTO, EXPLAIN ANALYZE DELETE, EXPLAIN (ANALYZE) DELETE Co-Authored-By: Claude Opus 4.6 * Fix: validate EXPLAIN ANALYZE inner statement with full read-only logic Reuse isReadOnlySQL recursively on the statement after EXPLAIN ANALYZE, so SELECT INTO and other write-capable forms are also caught. Co-Authored-By: Claude Opus 4.6 * Fix: handle EXPLAIN ANALYZE VERBOSE in read-only check Strip optional VERBOSE keyword after ANALYZE so the recursive isReadOnlySQL check receives the actual inner statement. Co-Authored-By: Claude Opus 4.6 * Fix: make REPLACE detection dialect-aware (MySQL/MariaDB only) REPLACE INTO is a MySQL/MariaDB-specific statement. In Postgres/SQLite/ SQL Server, REPLACE is only a function, so it should not trigger the mutating keyword check. This avoids false rejections when 'replace' appears as a CTE name or alias in non-MySQL dialects. Co-Authored-By: Claude Opus 4.6 * Fix: reject standalone ANALYZE, handle EXPLAIN (ANALYZE false/off) - Remove ANALYZE from allowed first keywords since it updates statistics (writes to system catalogs) in Postgres/MySQL/SQLite - EXPLAIN (ANALYZE false/off/0) does not execute, so allow it with DML - Add MySQL/MariaDB REPLACE() function tests to ensure no false positives Co-Authored-By: Claude Opus 4.6 * Fix: narrow MySQL REPLACE detection to REPLACE INTO statement form The previous regex `replace(?!\s*\()` rejected any standalone word `replace` that wasn't a function call, causing false positives for identifiers named `replace` (e.g. CTE aliases). Now only matches `REPLACE [LOW_PRIORITY|DELAYED] INTO` which is the actual MySQL REPLACE statement syntax. Co-Authored-By: Claude Opus 4.6 (1M context) * Fix: add REPLACE INTO detection for SQLite in read-only mode SQLite also supports REPLACE INTO, so the mutating keyword scan needs to detect it for SQLite connectors, not just MySQL/MariaDB. Co-Authored-By: Claude Opus 4.6 (1M context) * Refactor: simplify mutating pattern dispatch and avoid redundant work - Merge mutatingPatternSQLite into shared mutatingPatternWithReplace - Replace getMutatingPattern() with Record lookup - Use match(/\S+/) instead of split(/\s+/)[0] to avoid full array alloc - Use exec() + slice() instead of test() + replace() to avoid double regex - Extract checkReadOnly() to skip re-running stripCommentsAndStrings on recursive EXPLAIN ANALYZE calls - Unify selectIntoPattern branches for select/with Co-Authored-By: Claude Opus 4.6 (1M context) --------- Co-authored-by: Claude Opus 4.6

Sunbelt Computer Software

PL/B Language Development and Support