Reject unquoted reserved keywords as table names

fuzz/fuzz_seeds/clickhouse_2633_keyword_table_names.sql

@@ -0,0 +1,2 @@
+SELECT * FROM ON;
+SELECT * FROM t JOIN limit ON true;

fuzz/fuzz_seeds/generic_2633_quoted_keyword_table_names.sql

@@ -0,0 +1,2 @@
+SELECT * FROM "ON";
+SELECT * FROM `ON`;

src/dialect/clickhouse.rs

@@ -16,6 +16,8 @@
 // under the License.
 
 use crate::dialect::Dialect;
+use crate::keywords::Keyword;
+use crate::parser::Parser;
 
 /// A [`Dialect`] for [ClickHouse](https://clickhouse.com/).
 #[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
@@ -45,6 +47,12 @@ impl Dialect for ClickHouseDialect {
         self.is_identifier_start(ch) || ch.is_ascii_digit() || ch == '$'
     }
 
+    /// ClickHouse keywords are not reserved, so any of them can be a table name.
+    /// See <https://clickhouse.com/docs/en/sql-reference/syntax>
+    fn is_table_factor(&self, _kw: &Keyword, _parser: &mut Parser) -> bool {
+        true
+    }
+
     /// ClickHouse accepts both backticks and double quotes, but its own
     /// formatter emits backticks by default.
     /// See <https://clickhouse.com/docs/en/sql-reference/syntax#identifiers>

src/dialect/databricks.rs

@@ -16,6 +16,8 @@
 // under the License.
 
 use crate::dialect::Dialect;
+use crate::keywords::Keyword;
+use crate::parser::Parser;
 
 /// A [`Dialect`] for [Databricks SQL](https://www.databricks.com/)
 ///
@@ -57,6 +59,11 @@ impl Dialect for DatabricksDialect {
         matches!(ch, 'a'..='z' | 'A'..='Z' | '0'..='9' | '_')
     }
 
+    /// Databricks permits [keywords](https://docs.databricks.com/aws/en/sql/language-manual/sql-ref-reserved-words) as table names.
+    fn is_table_factor(&self, _kw: &Keyword, _parser: &mut Parser) -> bool {
+        true
+    }
+
     fn supports_numeric_prefix(&self) -> bool {
         true
     }

src/dialect/hive.rs

@@ -16,6 +16,8 @@
 // under the License.
 
 use crate::dialect::Dialect;
+use crate::keywords::{Keyword, RESERVED_FOR_TABLE_FACTOR};
+use crate::parser::Parser;
 
 /// A [`Dialect`] for [Hive](https://hive.apache.org/).
 #[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
@@ -62,6 +64,12 @@ impl Dialect for HiveDialect {
             || ch == '}'
     }
 
+    /// LIMIT is not reserved in Hive; identifiers may be nonReserved keywords.
+    /// See <https://github.com/apache/hive/blob/4e9caba7c02a947a39c60de427acb7189c8c1fe8/parser/src/java/org/apache/hadoop/hive/ql/parse/IdentifiersParser.g#L945>
+    fn is_table_factor(&self, kw: &Keyword, _parser: &mut Parser) -> bool {
+        kw == &Keyword::LIMIT || !RESERVED_FOR_TABLE_FACTOR.contains(kw)
+    }
+
     fn supports_filter_during_aggregation(&self) -> bool {
         true
     }

src/dialect/mssql.rs

@@ -21,7 +21,7 @@ use crate::ast::{
     GranteesType, IfStatement, Statement,
 };
 use crate::dialect::Dialect;
-use crate::keywords::Keyword;
+use crate::keywords::{Keyword, RESERVED_FOR_TABLE_FACTOR};
 use crate::parser::{Parser, ParserError};
 use crate::tokenizer::Token;
 #[cfg(not(feature = "std"))]
@@ -167,6 +167,12 @@ impl Dialect for MsSqlDialect {
         }
     }
 
+    /// LIMIT is not a reserved word in Transact-SQL.
+    /// See <https://learn.microsoft.com/en-us/sql/t-sql/language-elements/reserved-keywords-transact-sql>
+    fn is_table_factor(&self, kw: &Keyword, _parser: &mut Parser) -> bool {
+        kw == &Keyword::LIMIT || !RESERVED_FOR_TABLE_FACTOR.contains(kw)
+    }
+
     fn is_table_factor_alias(&self, explicit: bool, kw: &Keyword, parser: &mut Parser) -> bool {
         match kw {
             // List of keywords that cannot be used as table aliases in MSSQL

src/dialect/oracle.rs

@@ -22,7 +22,10 @@ use crate::{
     tokenizer::Token,
 };
 
-use super::{keywords::Keyword, Dialect, Precedence};
+use super::{
+    keywords::{Keyword, RESERVED_FOR_TABLE_FACTOR},
+    Dialect, Precedence,
+};
 
 const RESERVED_KEYWORDS_FOR_SELECT_ITEM_OPERATOR: [Keyword; 1] = [Keyword::CONNECT_BY_ROOT];
 
@@ -49,6 +52,12 @@ impl Dialect for OracleDialect {
         ch.is_alphanumeric() || ch == '_' || ch == '$' || ch == '#' || ch == '@'
     }
 
+    /// LIMIT is not a reserved word in Oracle SQL.
+    /// See <https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/Oracle-SQL-Reserved-Words.html>
+    fn is_table_factor(&self, kw: &Keyword, _parser: &mut Parser) -> bool {
+        kw == &Keyword::LIMIT || !RESERVED_FOR_TABLE_FACTOR.contains(kw)
+    }
+
     fn supports_outer_join_operator(&self) -> bool {
         true
     }

src/keywords.rs

@@ -1306,14 +1306,16 @@ pub const RESERVED_FOR_COLUMN_ALIAS: &[Keyword] = &[
     Keyword::END,
 ];
 
-/// Global list of reserved keywords allowed after FROM.
-/// Parser should call Dialect::get_reserved_keyword_after_from
-/// to allow for each dialect to customize the list.
+/// Global list of reserved keywords that cannot be parsed as a table
+/// factor name without special handling like quoting. Parser should
+/// call `Dialect::is_table_factor` to allow for each dialect to
+/// customize the list.
 pub const RESERVED_FOR_TABLE_FACTOR: &[Keyword] = &[
     Keyword::INTO,
     Keyword::LIMIT,
     Keyword::HAVING,
     Keyword::WHERE,
+    Keyword::ON,
 ];
 
 /// Global list of reserved keywords that cannot be parsed as identifiers

src/parser/mod.rs

@@ -17095,6 +17095,20 @@ impl<'a> Parser<'a> {
             // Stage reference: @mystage or @namespace.stage (e.g. Snowflake)
             self.parse_snowflake_stage_table_factor()
         } else {
+            // Unquoted reserved keywords, e.g. `ON`, are not table names. The
+            // keyword is consumed first so that `is_table_factor` peeks past it,
+            // as it does at the trailing comma check.
+            self.advance_token();
+            let keyword = match &self.get_current_token().token {
+                Token::Word(w) => w.keyword,
+                _ => Keyword::NoKeyword,
+            };
+            let is_table_name = self.dialect.is_table_factor(&keyword, self);
+            self.prev_token();
+            if !is_table_name {
+                return self.expected_ref("table name", self.peek_token_ref());
+            }
+
             let name = self.parse_object_name(true)?;
 
             let json_path = match &self.peek_token_ref().token {

tests/sqlparser_clickhouse.rs

@@ -220,6 +220,14 @@ fn parse_delimited_identifiers() {
     //TODO verified_stmt(r#"UPDATE foo SET "bar" = 5"#);
 }
 
+#[test]
+fn parse_non_reserved_keyword_table_names() {
+    for table_name in ["into", "limit", "having", "where", "on"] {
+        clickhouse().verified_stmt(&format!("SELECT * FROM {table_name}"));
+        clickhouse().verified_stmt(&format!("SELECT * FROM t JOIN {table_name} ON true"));
+    }
+}
+
 #[test]
 fn parse_create_table() {
     clickhouse().verified_stmt(r#"CREATE TABLE "x" ("a" "int") ENGINE = MergeTree ORDER BY ("x")"#);

tests/sqlparser_common.rs

@@ -1258,10 +1258,10 @@ fn parse_select_wildcard() {
 
 #[test]
 fn parse_count_wildcard() {
-    verified_only_select("SELECT COUNT(*) FROM Order WHERE id = 10");
+    verified_only_select("SELECT COUNT(*) FROM orders WHERE id = 10");
 
     verified_only_select(
-        "SELECT COUNT(Employee.*) FROM Order JOIN Employee ON Order.employee = Employee.id",
+        "SELECT COUNT(Employee.*) FROM orders JOIN Employee ON orders.employee = Employee.id",
     );
 }
 
@@ -18414,8 +18414,8 @@ fn parse_pipeline_operator_negative_tests() {
         ),
         // Test that JOIN without table name fails
         (
-            "SELECT * FROM users |> JOIN ON users.id = orders.user_id",
-            "Expected: end of statement, found: .",
+            "SELECT * FROM users |> JOIN",
+            "Expected: identifier, found: EOF",
         ),
         // Test that CROSS JOIN with ON condition fails
         (
@@ -20903,6 +20903,29 @@ fn parse_hex_string_literal_display_escaping() {
     all_dialects().one_statement_parses_to("SELECT x'''' N", "SELECT X'''' AS N");
 }
 
+#[test]
+fn on_keyword_rejected_as_table_name() {
+    let dialects = all_dialects_where(|d| !d.is_table_factor(&Keyword::ON, &mut Parser::new(d)));
+    for sql in [
+        "SELECT * FROM ON",
+        "SELECT * FROM t JOIN ON",
+        "SELECT * FROM t JOIN ON u ON TRUE",
+    ] {
+        assert_eq!(
+            ParserError::ParserError("Expected: table name, found: ON".to_string()),
+            dialects.parse_sql_statements(sql).unwrap_err()
+        );
+    }
+}
+
+#[test]
+fn quoted_on_allowed_as_table_name() {
+    let dialects = all_dialects_where(|d| d.is_delimited_identifier_start('"'));
+    dialects.verified_stmt(r#"SELECT * FROM "ON""#);
+    let dialects = all_dialects_where(|d| d.is_delimited_identifier_start('`'));
+    dialects.verified_stmt("SELECT * FROM `ON`");
+}
+
 #[test]
 fn parse_stage_table_factor() {
     let supported = all_dialects_where(|d| d.supports_stages());

tests/sqlparser_databricks.rs

@@ -55,6 +55,19 @@ fn test_databricks_identifiers() {
     );
 }
 
+#[test]
+fn parse_non_reserved_keyword_table_names() {
+    for name in ["limit", "where", "on", "into", "having"] {
+        let sql = format!("SELECT * FROM {name}");
+        let select = databricks().verified_only_select(&sql);
+        assert_eq!(select.from[0].relation, table(name));
+
+        let sql = format!("SELECT * FROM t JOIN {name} ON true");
+        let select = databricks().verified_only_select(&sql);
+        assert_eq!(select.from[0].joins[0].relation, table(name));
+    }
+}
+
 #[test]
 fn test_databricks_exists() {
     // exists is a function in databricks

tests/sqlparser_hive.rs

@@ -233,6 +233,12 @@ fn test_identifier() {
     hive().verified_stmt(between);
 }
 
+#[test]
+fn parse_non_reserved_keyword_table_names() {
+    hive().verified_stmt("SELECT * FROM limit");
+    hive().verified_stmt("SELECT * FROM t JOIN limit ON true");
+}
+
 #[test]
 fn test_alter_partition() {
     let alter = "ALTER TABLE db.table PARTITION (a = 2) RENAME TO PARTITION (a = 1)";

tests/sqlparser_mssql.rs

@@ -2670,6 +2670,12 @@ fn test_sql_keywords_as_table_aliases() {
     }
 }
 
+#[test]
+fn parse_non_reserved_keyword_table_names() {
+    ms().verified_stmt("SELECT * FROM limit");
+    ms().verified_stmt("SELECT * FROM t JOIN limit ON true");
+}
+
 #[test]
 fn test_sql_keywords_as_column_aliases() {
     // Some keywords that should not be parsed as an alias implicitly or explicitly

tests/sqlparser_oracle.rs

@@ -539,3 +539,9 @@ fn test_insert_without_alias() {
         if matches!(&*source, Query { body, .. } if matches!(&**body, SetExpr::Values(_)))
     ));
 }
+
+#[test]
+fn parse_non_reserved_keyword_table_names() {
+    oracle().verified_stmt("SELECT * FROM limit");
+    oracle().verified_stmt("SELECT * FROM t JOIN limit ON TRUE");
+}