Finish merging from 5.10.x

Signed-off-by: Isaac Bennetch <[email protected]>
phpmyadmin · Jan 19, 2025 · bfdd503 · bfdd503
2 parents 2142141 + a33af14
commit bfdd503
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,16 +1,19 @@
 # Change Log
 
-# [5.11.0] - YYYY-MM-DD
+## [5.11.0] - YYYY-MM-DD
 
 ### Added
 
 - Add Translator::setLocale() method (#599)
 
-# [5.10.3] - YYYY-MM-DD
+## [5.10.4] - YYYY-MM-DD
+
+## [5.10.3] - 2024-01-18
 
 ### Fixed
 
 - Add "RECURSIVE" on build() for "WITH RECURSIVE" on the WithStatement class (#605)
+- Fix for quadratic complexity in certain queries, which could have caused long execution times. Thanks to Maximilian Krög (GitHub user MoonE) for this fix to help improve security.
 
 ## [5.10.2] - 2024-12-05
 
@@ -609,6 +612,7 @@ __Breaking changes:__
 
 * First release of this library.
 
+[5.10.3]: https://github.com/phpmyadmin/sql-parser/compare/5.10.2...5.10.3
 [5.10.2]: https://github.com/phpmyadmin/sql-parser/compare/5.10.1...5.10.2
 [5.10.1]: https://github.com/phpmyadmin/sql-parser/compare/5.10.0...5.10.1
 [5.10.0]: https://github.com/phpmyadmin/sql-parser/compare/5.9.1...5.10.0

diff --git a/src/Lexer.php b/src/Lexer.php
@@ -892,6 +892,7 @@ public function parseNumber()
                 ) {
                     // A number can't be directly followed by a letter
                     $state = -$state;
+                    break;
                 } elseif ($this->str[$this->last] < '0' || $this->str[$this->last] > '9') {
                     // Just digits and `.`, `e` and `E` are valid characters.
                     break;
@@ -906,6 +907,7 @@ public function parseNumber()
                 ) {
                     // A number can't be directly followed by a letter
                     $state = -$state;
+                    break;
                 } elseif ($this->str[$this->last] < '0' || $this->str[$this->last] > '9') {
                     // Just digits, `e` and `E` are valid characters.
                     break;
@@ -923,6 +925,7 @@ public function parseNumber()
                 ) {
                     // A number can't be directly followed by a letter
                     $state = -$state;
+                    break;
                 } else {
                     break;
                 }