Skip to content

[BUG] Cosmos P2: ORDER BY continuation predicates incorrectly escape strings #51134

Open

Description

Describe the bug
Alan Zimmer's November 6, 2026 audit of com.azure:azure-cosmos:4.84.0-beta.1 reports that Java regex replacement processing consumes the intended escape backslash when constructing ORDER BY continuation predicates. A stored value a"b becomes the malformed SQL literal "a"b" in a resumed query. Backslashes and control characters are also unhandled and can change comparison values. Reported priority: P2.

Exception or Stack Trace
No SDK/service stack trace supplied. The reported helper output contains a malformed SQL string literal.

To Reproduce
Construct an ORDER BY continuation predicate for a stored value containing a quote, such as a"b. Also cover backslashes and control characters. Compare uninterrupted and resumed query execution and verify that continuation predicates preserve the original comparison values.

Code Snippet
No complete executable snippet supplied. Reported location: OrderByDocumentQueryExecutionContext.java:444-447 in the audited source. The exact helper reportedly emitted "a"b" for input a"b in a standalone JDK probe.

Expected behavior
String comparison values are correctly serialized or parameterized in continuation predicates. Resumed queries are valid and return results equivalent to uninterrupted queries for quotes, backslashes, and control characters.

Screenshots
N/A.

Setup (please complete the following information):

  • OS: Not reported.
  • IDE: Not reported.
  • Library/Libraries: com.azure:azure-cosmos:4.84.0-beta.1.
  • Java version: JDK probe; exact version not supplied.
  • App Server/Environment: ORDER BY query continuation.
  • Frameworks: Not reported.

Dependency mismatch: Not indicated; dependency tree/logs were not supplied.

Additional context
Proposed fix from the audit: use proper JSON string serialization or SQL parameters instead of ad hoc regex escaping.

Regression coverage: compare uninterrupted and resumed queries with string values containing quotes, backslashes, and control characters; assert valid predicates and identical comparison values/results.

Evidence: Alan reproduced the exact helper's malformed output at the standalone JDK-helper level, not through live query execution. No live Cosmos calls or full SDK test suite were run, and no repository files were changed. This issue tracks validation and implementation of the proposed fix, not an already-applied fix.

Information Checklist

  • Bug Description Added
  • Repro Steps Added
  • Setup information Added

Activity

  1. added a commit that references this issue on Nov 10, 2026
    8a51509
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    ClientThis issue points to a problem in the data-plane of the library.Cosmos

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions