Skip to content

Invalid LIKE/ILIKE escape strings are silently accepted instead of rejected #7804

Description

@wjones127

In Planner::parse_sql_expr, the SQLExpr::Like and SQLExpr::ILike arms extract the escape character with char.chars().next():

https://github.com/lance-format/lance/blob/main/rust/lance-datafusion/src/planner.rs#L786
https://github.com/lance-format/lance/blob/main/rust/lance-datafusion/src/planner.rs#L808

This silently mishandles invalid escape specifiers instead of returning an input error:

  • ... LIKE 'x' ESCAPE ''chars().next() yields None, so the predicate runs with no escape character.
  • ... LIKE 'x' ESCAPE 'ab'chars().next() yields 'a', silently truncating the two-character input to one.

Both change predicate behavior rather than rejecting bad input, which contradicts the project's "validate inputs and reject invalid values with descriptive errors at API boundaries — never silently clamp or adjust" guideline.

Expected: require exactly one character. Reject empty and multi-character escape strings with a descriptive error (matching the existing error for non-SingleQuotedString escape values just below).

Add tests covering ESCAPE '', ESCAPE 'ab', and the valid single-char case, for both LIKE and ILIKE.

Note: this is pre-existing behavior (unrelated to any DataFusion upgrade); surfaced by CodeRabbit review on #7793.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions