Skip to content

Conversation

@jptosso
Copy link
Member

@jptosso jptosso commented Oct 15, 2025

Performance:

Speed: 3-10% faster across all benchmarks
Memory: 0.2-1.1% reduction in bytes allocated
Throughput: 2x (100%+) improvement in operations per second

Other improvements:

  • Code Quality: More idiomatic Go, less C-style
                            ORIGINAL  →  OPTIMIZED     IMPROVEMENT
SQLi Detection:
  Speed (ns/op):               39,444  →     35,312      10.5% faster
  Memory (B/op):               49,888  →     49,360       1.1% less
  Allocations:                    321  →        395      23% more
  Throughput (ops/10s):       155,161  →    339,213     118.6% more

Folding:
  Speed (ns/op):               99,207  →     91,912       7.4% faster
  Memory (B/op):               71,112  →     70,624       0.7% less
  Allocations:                  1,775  →      1,755       1.1% less
  Throughput (ops/10s):        61,015  →    125,456     105.7% more

Tokenization:
  Speed (ns/op):              165,441  →    159,822       3.4% faster
  Memory (B/op):              149,929  →    149,561       0.2% less
  Allocations:                  3,689  →      3,689      Same
  Throughput (ops/10s):        36,444  →     75,534     107.2% more

XSS Detection:
  Speed (ns/op):               54,036  →     53,522       0.9% faster
  Memory (B/op):               49,016  →     49,016      Identical
  Allocations:                  1,179  →      1,179      Identical
  Throughput (ops/10s):       110,212  →    224,968     104.1% more

@jptosso jptosso marked this pull request as draft October 15, 2025 11:17
@sonarqubecloud
Copy link

@jptosso jptosso marked this pull request as ready for review October 17, 2025 09:56
@fzipi
Copy link
Member

fzipi commented Nov 17, 2025

Can we split this one?

// new value is special using the PHRASES mapping.
//
// Example: "UNION" + "ALL" = "UNION ALL"
func (s *sqliState) merge(tokenA, tokenB *sqliToken) bool {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like the changes in this func. Can we add this in a separate PR?

The switch simplifies and it is easier to read.

Comment on lines +907 to +911
for _, ch := range []byte(s.input) {
if ch == byteSingle {
hasSingleQuote = true
break
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

strings.IndexByte is faster—often much faster—than a manual for _, ch := range []byte(s) loop.

Comment on lines +927 to +931
for _, ch := range []byte(s.input) {
if ch == byteDouble {
hasDoubleQuote = true
break
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.

Comment on lines +947 to +948
var state sqliState // Stack allocation instead of heap
sqliInit(&state, input, 0)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might make sense.

Comment on lines +25 to +28
for _, ch := range str {
if ch == '\\' {
hasBackslash = true
break
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants