Repository navigation
Refuse overflowing numeric literals in schedule visibility queries #699
Description
Problem
Published Server 2.11.1, source 5336a98dd256e046edfdb67c81764cde4babd360, accepts lossy numeric literals in ScheduleVisibilityQuery::parseLiteral. An out-of-range integer is cast to a PHP integer boundary, and an overflowing decimal is accepted as INF. These values should be refused instead of changing the requested predicate.
Narrow reproduction and counterfactual
An isolated control loads that exact published parser and its exception class. A synthetic in-memory definition lookup supplies Count => int and Weight => double; no Server process, database, customer data or live service is involved. The same results reproduce on PHP 8.3.36 and 8.5.12, both 64-bit.
| Query | Actual parser result | Expected |
|---|---|---|
Count = 9223372036854775807 |
Accepts the exact integer | Accept unchanged: valid boundary control |
Count = 9223372036854775808 |
Accepts integer 9223372036854775807 |
Refuse before query execution |
Count = -9223372036854775809 |
Accepts integer -9223372036854775808 |
Refuse before query execution |
Weight = followed by 400 9 digits and .0 |
Accepts floating-point INF |
Refuse before query execution |
The three invalid inputs unexpectedly return a parsed predicate instead of raising ScheduleVisibilityQueryException. This is a confirmed parser-level counterfactual, not a claim that a full Server HTTP/SQL experiment ran. The decimal input is below the list endpoint's 2,048-character query limit.
Acceptance
- Validate integer range before casting and refuse positive and negative overflow rather than clamp it. Keep the exact in-range boundary values supported.
- Reject non-finite numeric literals before binding or querying.
- Use the existing typed
invalid_schedule_visibility_queryrefusal: the parser raisesScheduleVisibilityQueryException, andGET /api/schedulesresponds 422 for these invalid queries. Verify that the backend query does not execute. - Add focused parser and actual HTTP/database controls, including the valid boundary counterfactuals. Qualify the exact corrected published Server artifact through its normal owner.
Found during the Waterline schedule-query parity investigation, coordinated under shared #224. Server correction remains separate from Waterline's active request-budget release; no Waterline release hold or foreign implementation is introduced by this finding.
Activity
rmcdaniel commentedon Nov 4, 2026
Server open-item pass, 2026-11-04.
Owner: Server for native schedule-query parity; Waterline/Workflow own the central #224 shared parser/vector handoff. The retained PHP counterfactual remains valid evidence for that exact source. I linked the overflow cases into the portable vector boundary rather than widening native grammar casually.
Next controls cover signed64-bit extrema and one-past, finite doubles versus overflow/nonfinite, and no backend query on refusal. Preserve typed invalid_schedule_visibility_query422 and exact in-range values. Waterline: include these vectors in the offered parser/planner slice; Server will compare native's existing literal parser and classify any legacy PHP exception explicitly. No PHP release or new backend experiment is requested.
rmcdaniel commentedon Nov 5, 2026
Native #699 source work is now preserved alongside the exact-single-token fix, at
2c47c4e09f65c9e05f10ed4113909da16be41a35onfix/server-schedule-query-literals. The current saturating i64 conversion is replaced by a range-checked refusal; decimal conversion must be finite. Dedicated Count/Weight parser cases preserve signed extrema and finite/signed-zero doubles, then reject one-past extrema and decimal overflow. The new HTTP/database test makes the schedule table unavailable, so invalid input must return parser 422 without executing that query, while a valid input reaches storage_unavailable 503. Runtime/database cleanup follows the existing test helpers.The 1040 source record also binds the exact 37 shared system-field vectors; their numeric Note cases alone are not treated as isolated overflow proof. Rust controls are authored but not yet executed or qualified. The next action is maintained-base ordinary source CI after the active #1036/#1041 pacing step, then actual native publication/HTTP/database acceptance on a separately selected tuple. This remains open; no corrected published artifact or PHP Server release is claimed. Owner: server.
rmcdaniel commentedon Nov 5, 2026
The native correction is now draft Server #1042, exact
e35fb78c0e6dcdcc6c09ecfeb1f345779753b7eb/ tree6c6a9a055b3ce6374ddfdb1df0c1f07afb2bd8f4on actual accepted main0166afb225c75feb8f67d2d8963e49183550763cafter #1039 acceptance and cleanup.The normal refresh preserves all four prepared feature blobs, including the exact Workflow
d28ec380fixture: 7,903 bytes / 37 unique cases / SHA-25623786cdc9d4b784ee85fcc8c787e40949f0876383de72f316449c54f8a7f0f24. It requires one complete single-quoted token, preserves escaped/unknown-escape semantics, rejects signed-integer overflow and makes non-finite decimal refusal explicit. Separate Count/Weight controls avoid confusing text-field type refusal with numeric-range validation. The API test makes the schedule table unavailable so malformed literals must refuse before the schedule query, while a valid filter reaches the storage error.Fresh ordinary CI is running for this exact pair. The PR is draft, auto-merge is off and no issue-closing reference is selected. Local checks establish unchanged feature/fixture bytes, normal ancestry and clean source; Rust/backend execution is still unclaimed until the actual CI cells complete. Publication workflows are unchanged: native publication/promotion are dispatch-only, PHP publish remains retired with
if: false, and this branch changes no chart path. No release or published parity is selected.Server owns qualification, corrections and the normal protected source queue. Published native acceptance remains a later #325 tuple gate, so #1040/#699 stay open. The frozen fixture's
c577reference remains historical and is never relabelled as passing these added refusals.rmcdaniel commentedon Nov 6, 2026
The narrow native literal correction is now normally merged in #1042 at
7c9e3f971264ffccac90c5e6881fe3d3e33d7efc, with original queue and automatic actual-main checks successful. Acceptance receipt and the 37-case source handoff retain the exact fixture identity.This closes the source defects for adjacent single-quoted tokens, integer overflow and nonfinite numeric literals in the bounded native parser. It does not qualify the broader numeric value/matching/storage contract or published PHP/native parity. #699 remains open for those acceptance criteria; the next native artifact qualification still needs the exact immutable tuple tracked in #325.