Skip to content

Wrapped unary negation under IS NULL can escape analyzer type validation #20988

@myandpr

Description

@myandpr

Describe the bug

An invalid unary negation expression can escape analyzer/type coercion validation when wrapped by IS NULL.

For example, SELECT * FROM (SELECT 1) WHERE ((-'a') IS NULL) is accepted during planning and optimization, even though -'a' is not a valid negation expression.

To Reproduce

#[tokio::test]
async fn wrapped_negation_is_accepted() {
    let ctx = SessionContext::new();

    let plan = ctx
        .sql("SELECT * FROM (SELECT 1) WHERE ((-'a') IS NULL)")
        .await
        .unwrap()
        .into_optimized_plan();

    assert!(plan.is_ok());
}

I also verified that the same query executes successfully and returns Ok([]) before the fix.

Expected behavior

Invalid wrapped negation expressions such as (-'a') IS NULL should be rejected during analyzer/type coercion, rather than being accepted.

Additional context

This appears to be a gap in expression validation for Expr::Negative.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions