bug: SQL semicolon check rejects semicolons inside string literals

[jonchun]

Summary

The validateSQL semicolon check uses a naive strings.Contains(content, ";") after stripping the trailing semicolon. This rejects valid queries containing semicolons inside string literals, e.g., SELECT * FROM t WHERE name = 'foo;bar'.

Location

validator/validator.go:377-378

content := strings.TrimSuffix(stripped, ";")
if strings.Contains(content, ";") {

Impact

False positive — valid read-only queries with semicolons in string values are rejected. This is safe (fails closed) but overly conservative.

Suggested Fix

Track quote state when scanning for internal semicolons, or reuse the isInsideQuote helper from the CTE validation logic.