Hidden Assumptions in surrealdb
13 assumptions this code never checks · 5 critical · spanning Shape, Ordering, Contract, Temporal, Resource, Domain, Scale, Environment
Every codebase relies on things it never checks. Most of them are routine. CodeSea looked at surrealdb/surrealdb and picked out the few most likely to cause trouble. The full list is just below.
Most of what this code assumes is routine. These 3 are the ones most likely to cause trouble here. The rest are minor; they're under "Show everything".
If the extras field contains corrupted data or wrong type, the whitespace detection silently fails and tokens may be joined incorrectly, leading to parse errors that don't point to the real issue
If a Parse implementation calls parser.push() before the parsed object is complete, the AST contains half-initialized nodes that cause crashes during query execution
When invalid UTF-8 appears mid-stream, the lookahead buffer fills with None values, causing the parser to make wrong decisions based on phantom end-of-input, potentially accepting malformed queries
Show everything (10 more)
The FlatBufferBuilder::finish() call assumes the Value tree contains no cycles and will always terminate, but Value can contain Object/Array types that could reference each other
If this fails: If a Value contains circular references (Object A contains Array B which contains Object A), the serialization enters infinite recursion and crashes with stack overflow
surrealdb/types/src/flatbuffers/mod.rs:encode
WASM function execution assumes the host can always interrupt guest code via epoch timeout, but some WASM operations (like large memory allocations) are atomic and cannot be interrupted
If this fails: A malicious or buggy WASM function could perform a massive memory allocation that blocks the epoch interrupt, causing the server to hang indefinitely despite timeout configuration
surrealism/runtime/src/lib.rs:epoch-based timeouts
The default endpoint 'ws://localhost:8000' assumes WebSocket protocol and port 8000 is available, but there's no runtime verification that this protocol/port combination actually works
If this fails: If port 8000 is blocked or the server only supports HTTP, connections fail with cryptic WebSocket errors instead of clear protocol mismatch messages
surrealdb/server/src/cli/abstraction/mod.rs:DatabaseConnectionArguments
Parser speculation assumes backtracking depth is bounded, but complex grammar ambiguities could cause exponential backtrack explosion without any limits
If this fails: Pathological input queries with deep ambiguity cause the parser to backtrack exponentially, consuming CPU and memory until the server becomes unresponsive
surrealdb/parser/src/parse/mod.rs:speculating mode
Export name validation assumes ASCII alphanumeric and underscore are the only valid characters, but doesn't account for Unicode identifier rules that Rust itself supports
If this fails: Valid Rust function names with Unicode characters get rejected during macro processing, preventing legitimate non-English codebases from using Surrealism
surrealism/macros/src/attr.rs:validate_export_name
The execute! macro assumes block_on() can safely nest and that no other async runtime is already running on the current thread
If this fails: If called from within an existing async context, block_on() panics with 'Cannot start a runtime from within a runtime', breaking benchmark execution
surrealdb/core/benches/common/mod.rs:execute macro
The decode function assumes the input byte slice contains a valid FlatBuffers root table of type Value, but doesn't validate the FlatBuffers magic number or schema version
If this fails: Passing random binary data or FlatBuffers with wrong schema causes undefined behavior in flatbuffers::root(), potentially reading garbage memory as valid data
surrealdb/types/src/flatbuffers/mod.rs:decode
The SDK_VERSION constant assumes CARGO_PKG_VERSION is always available and correctly formatted as a semver string at compile time
If this fails: If built outside Cargo context or with malformed version metadata, the constant contains invalid version data, breaking module compatibility checks
surrealism/runtime/src/lib.rs:SDK_VERSION
Environment variable parsing assumes SURREAL_* variables contain UTF-8 strings, but environment variables can contain arbitrary bytes on Unix systems
If this fails: Invalid UTF-8 in environment variables causes clap to panic during argument parsing instead of showing user-friendly error messages
surrealdb/server/src/cli/abstraction/mod.rs:AuthArguments
The Token struct assumes Span contains valid byte offsets into the original source text that remain valid throughout the token's lifetime
If this fails: If the source text is modified or freed while tokens still reference it, Span offsets point to garbage memory, causing crashes when generating error messages
surrealdb/token/src/lib.rs:Token struct
See the full structural analysis of surrealdb: the pipeline, data models, and system behavior that put these assumptions in context.
Full analysis of surrealdb/surrealdb →Frequently Asked Questions
What does surrealdb assume that could break in production?
The one most likely to cause trouble: The logos lexer extras field is always valid Joined enum when whitespace_callback modifies it to Joined::Seperated, but there's no validation that the extras field contains a Joined value before mutation If this fails, If the extras field contains corrupted data or wrong type, the whitespace detection silently fails and tokens may be joined incorrectly, leading to parse errors that don't point to the real issue
How many hidden assumptions does surrealdb have?
CodeSea found 13 assumptions surrealdb relies on but never validates, 5 of them critical, spanning Shape, Ordering, Contract, Temporal, Resource, Domain, Scale, Environment. Most are routine — the analysis flags the two or three most likely to actually bite.
What is a hidden assumption?
Something the code depends on but never checks: a data shape, an ordering, an environment condition, a scale limit, or a contract with another service. It holds until the world it runs in changes, then fails silently.