From 196903b0b7c91418a2e23c6e39dcf83fd9845ed5 Mon Sep 17 00:00:00 2001
From: "kyle.cao" <kyle.cao@vesoft.com>
Date: Thu, 4 Nov 2021 13:51:05 +0800
Subject: [PATCH] disable yield var

---
 src/parser/parser.yy                          |  7 +++++
 .../bugfix/VariableExpression.feature         | 26 +++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 tests/tck/features/bugfix/VariableExpression.feature

diff --git a/src/parser/parser.yy b/src/parser/parser.yy
index 7b5259a7eaf..7704d393734 100644
--- a/src/parser/parser.yy
+++ b/src/parser/parser.yy
@@ -1436,9 +1436,16 @@ yield_column
         delete $3;
     }
     | expression {
+        if (!graph::ExpressionUtils::collectAll($1, {Expression::Kind::kVar}).empty()) {
+            throw nebula::GraphParser::syntax_error(@1, "Direct output of variable is prohibited");
+        }
         $$ = new YieldColumn($1);
     }
     | expression KW_AS name_label {
+        if (!graph::ExpressionUtils::collectAll($1, {Expression::Kind::kVar}).empty()) {
+            delete $3;
+            throw nebula::GraphParser::syntax_error(@1, "Direct output of variable is prohibited");
+        }
         $$ = new YieldColumn($1, *$3);
         delete $3;
     }
diff --git a/tests/tck/features/bugfix/VariableExpression.feature b/tests/tck/features/bugfix/VariableExpression.feature
new file mode 100644
index 00000000000..d95560d681f
--- /dev/null
+++ b/tests/tck/features/bugfix/VariableExpression.feature
@@ -0,0 +1,26 @@
+# Copyright (c) 2021 vesoft inc. All rights reserved.
+#
+# This source code is licensed under Apache 2.0 License,
+# attached with Common Clause Condition 1.0, found in the LICENSES directory.
+Feature: Variable usage
+
+  Background:
+    Given a graph with space named "nba"
+
+  Scenario: disable yield $var
+    When executing query:
+      """
+      $var = yield 1;$var2 = yield 3;yield $var1 + $var2
+      """
+    Then a SyntaxError should be raised at runtime: Direct output of variable is prohibited near `$var1 + $var2'
+    When executing query:
+      """
+      $var=go from "Tim Duncan" over like yield like._dst as dst;yield $var
+      """
+    Then a SyntaxError should be raised at runtime: Direct output of variable is prohibited near `$var'
+    Then drop the used space
+    When executing query:
+      """
+      $var=go from "Tim Duncan" over like yield like._dst as dst;yield $var[0][0]
+      """
+    Then a SyntaxError should be raised at runtime: Direct output of variable is prohibited near `$var[0][0]'