fix: Don't silently accept multi-table FROM clauses (eg: implicit JOI…

…N syntax)

crates/polars-sql/src/context.rs

@@ -181,7 +181,7 @@ impl SQLContext {
     }
 
     pub(crate) fn execute_query_no_ctes(&mut self, query: &Query) -> PolarsResult<LazyFrame> {
-        let lf = self.process_set_expr(&query.body, query)?;
+        let lf = self.process_query(&query.body, query)?;
         self.process_limit_offset(lf, &query.limit, &query.offset)
     }
 
@@ -263,7 +263,7 @@ impl SQLContext {
         }
     }
 
-    fn process_set_expr(&mut self, expr: &SetExpr, query: &Query) -> PolarsResult<LazyFrame> {
+    fn process_query(&mut self, expr: &SetExpr, query: &Query) -> PolarsResult<LazyFrame> {
         match expr {
             SetExpr::Select(select_stmt) => self.execute_select(select_stmt, query),
             SetExpr::Query(query) => self.execute_query_no_ctes(query),
@@ -326,8 +326,8 @@ impl SQLContext {
             } => (JoinType::Anti, "EXCEPT"),
             _ => (JoinType::Semi, "INTERSECT"),
         };
-        let mut lf = self.process_set_expr(left, query)?;
-        let mut rf = self.process_set_expr(right, query)?;
+        let mut lf = self.process_query(left, query)?;
+        let mut rf = self.process_query(right, query)?;
         let join = lf
             .clone()
             .join_builder()
@@ -364,8 +364,8 @@ impl SQLContext {
         quantifier: &SetQuantifier,
         query: &Query,
     ) -> PolarsResult<LazyFrame> {
-        let mut lf = self.process_set_expr(left, query)?;
-        let mut rf = self.process_set_expr(right, query)?;
+        let mut lf = self.process_query(left, query)?;
+        let mut rf = self.process_query(right, query)?;
         let opts = UnionArgs {
             parallel: true,
             to_supertypes: true,
@@ -586,7 +586,11 @@ impl SQLContext {
         let mut lf = if select_stmt.from.is_empty() {
             DataFrame::empty().lazy()
         } else {
-            self.execute_from_statement(select_stmt.from.first().unwrap())?
+            let from = select_stmt.clone().from;
+            if from.len() > 1 {
+                polars_bail!(SQLInterface: "multiple tables in FROM clause are not currently supported (found {}); use explicit JOIN syntax instead", from.len())
+            }
+            self.execute_from_statement(from.first().unwrap())?
         };
         let mut contains_wildcard = false;
         let mut contains_wildcard_exclude = false;

crates/polars-sql/src/sql_expr.rs

@@ -596,7 +596,7 @@ impl SQLExprVisitor<'_> {
                 },
             },
             other => {
-                polars_bail!(SQLInterface: "SQL operator {:?} is not currently supported", other)
+                polars_bail!(SQLInterface: "operator {:?} is not currently supported", other)
             },
         })
     }
@@ -772,7 +772,7 @@ impl SQLExprVisitor<'_> {
                 bitstring_to_bytes_literal(b)?
             },
             SQLValue::SingleQuotedString(s) => lit(s.clone()),
-            other => polars_bail!(SQLInterface: "SQL value {:?} is not supported", other),
+            other => polars_bail!(SQLInterface: "value {:?} is not supported", other),
         })
     }
 
@@ -826,7 +826,7 @@ impl SQLExprVisitor<'_> {
             SQLValue::SingleQuotedString(s) | SQLValue::DoubleQuotedString(s) => {
                 AnyValue::StringOwned(s.into())
             },
-            other => polars_bail!(SQLInterface: "SQL value {:?} is not currently supported", other),
+            other => polars_bail!(SQLInterface: "value {:?} is not currently supported", other),
         })
     }
 
@@ -845,11 +845,11 @@ impl SQLExprVisitor<'_> {
 
         let low = self.convert_temporal_strings(&expr, &low);
         let high = self.convert_temporal_strings(&expr, &high);
-        if negated {
-            Ok(expr.clone().lt(low).or(expr.gt(high)))
+        Ok(if negated {
+            expr.clone().lt(low).or(expr.gt(high))
         } else {
-            Ok(expr.clone().gt_eq(low).and(expr.lt_eq(high)))
-        }
+            expr.clone().gt_eq(low).and(expr.lt_eq(high))
+        })
     }
 
     /// Visit a SQL `TRIM` function.
@@ -891,11 +891,11 @@ impl SQLExprVisitor<'_> {
     ) -> PolarsResult<Expr> {
         let subquery_result = self.visit_subquery(subquery, SubqueryRestriction::SingleColumn)?;
         let expr = self.visit_expr(expr)?;
-        if negated {
-            Ok(expr.is_in(subquery_result).not())
+        Ok(if negated {
+            expr.is_in(subquery_result).not()
         } else {
-            Ok(expr.is_in(subquery_result))
-        }
+            expr.is_in(subquery_result)
+        })
     }
 
     /// Visit `CASE` control flow expression.

py-polars/tests/unit/sql/test_joins.py

@@ -306,3 +306,20 @@ def test_non_equi_joins(constraint: str) -> None:
             LEFT JOIN tbl ON {constraint}  -- not an equi-join
             """
         )
+
+
+def test_implicit_joins() -> None:
+    # no support for this yet; ensure we catch it
+    with pytest.raises(
+        SQLInterfaceError,
+        match=r"not currently supported .* use explicit JOIN syntax instead",
+    ), pl.SQLContext(
+        {"tbl": pl.DataFrame({"a": [1, 2, 3], "b": [4, 3, 2], "c": ["x", "y", "z"]})}
+    ) as ctx:
+        ctx.execute(
+            """
+            SELECT t1.*
+            FROM tbl AS t1, tbl AS t2
+            WHERE t1.a = t2.b
+            """
+        )