No Escaping for LIKE Patterns from Runtime Variables

[richardwooding]

Summary

Non-literal LIKE patterns from variables aren't escaped, causing incorrect matching.

Location

cel2sql.go:291-297, 333-338

Issue

// For non-literal patterns
con.str.WriteString(" || '%'")  // Variable may contain % or _

Impact

Medium - Incorrect pattern matching when variables contain wildcards.

Recommendation

Either:

1. Use REPLACE() to escape at runtime
2. Document limitation
3. Return error for non-literal patterns

[richardwooding]

Status: Confirmed - Still Valid

When LIKE patterns come from variables (not string literals), they aren't escaped, which can cause incorrect matching.

Example Problem:

// CEL: user.name.startsWith(prefix_var)
// If prefix_var contains "test%data", it generates:
// SQL: user.name LIKE prefix_var || '%'
// This treats % as a wildcard instead of a literal character

Impact: Variables containing % or _ will be interpreted as SQL wildcards instead of literal characters, causing incorrect pattern matching.

Recommended Solutions:

1. Use PostgreSQL's REPLACE() to escape at runtime:

   LIKE REPLACE(REPLACE(var, '\\', '\\\\'), '%', '\\%') || '%'

2. Document the limitation clearly in README/docs
3. Return an error for non-literal patterns (breaking change)

This is a subtle but important correctness issue.