The synthetic SQL check (and custom rules) used a regex that ended an [identifier]
at the first ] and a block comment at the first */, so "[x]]'] DELETE ..." hid a
DELETE inside what it took for a string. T-SQL also needs no semicolon between
statements, so "SELECT 1 COMMIT" or "SELECT 1 WRITETEXT ..." passed.
- ReadOnlyQuery lexes T-SQL as SQL Server does (nested comments, '' ]] ""),
refuses unterminated comments/strings/identifiers, every statement keyword
(COMMIT, ROLLBACK, SET, DECLARE, WRITETEXT, UPDATETEXT, RAISERROR, CHECKPOINT,
ENABLE/DISABLE, RECEIVE/SEND ...), NEXT VALUE FOR (sequences are not rolled
back) and update/exclusive lock hints, and a second SELECT unless joined by
UNION/EXCEPT/INTERSECT.
- CustomRuleDefinition.QueryProblems uses it, so the synthetic check validates the
same way when saved and before it runs.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
