复杂 postgresql sql 查询的语法错误

Question

I need to insert multiple related tables simultaneously into postgres.

My query looks like

          WITH report AS (
            INSERT INTO reports(
                source_type, 
                target, 
                db_date,
                grype_version, 
                distro_name, 
                distro_version, 
                project_id)
            VALUES(
                 'directory',
                 '.',
                 '2022-01-16T00:15:11.000-08:00',
                 '0.28.0',
                 '',
                 '',
                 'f11d9a9c-0398-40aa-a1fa-1be563e5f7bd'
            ) RETURNING id
    
          ) 
          -- The below part repeats many hundreds of times, but I have limited to just one for now
          WITH vuln AS (
            SELECT id FROM vulnerabilities WHERE slug = 'CVE-2008-0732:nvd' RETURNING id
          ), pkg AS (        
            SELECT id FROM vulnerability_packages WHERE slug = 'CVE-2008-0732:nvd:geronimo-j2ee-management_1.1_spec' RETURNING id
          ), version AS (
            SELECT id FROM package_versions WHERE slug = 'CVE-2008-0732:nvd:geronimo-j2ee-management_1.1_spec:none (unknown)' RETURNING id
          )
          INSERT INTO findings(
            vulnerability_id,
            vulnerability_package_id,
            package_version_id,
            report_id,
            package_name,
            version,
            version_matcher,
            type,
            locations,
            language,
            purl,
            virtual_path,
            matcher
          ) VALUES (
            vuln.id,
            pkg.id,
            version.id,
            report.id,
            'geronimo-j2ee-management_1.1_spec',
            '1.0.1',
            'none (unknown)',
            'java-archive',
            array['tools/log4shell/test/vulnerable-services/zipkin-server-2.23.15-exec.jar'],
            'java',
            'pkg:maven/org.apache.geronimo.specs/geronimo-j2ee-management_1.1_spec@1.0.1',
            'tools/log4shell/test/vulnerable-services/zipkin-server-2.23.15-exec.jar:BOOT-INF/lib/geronimo-j2ee-management_1.1_spec-1.0.1.jar',
            'java-matcher'
          );

As you can see, I want to first insert a 'report', then take it's ID and and use it in the subsequent insertions of 'finding'. When I insert a finding, I also need to fetch a few more IDs to create relations from other tables that already exist. You can see that with the subqueries named vuln , pkg , and version .

I am getting a syntax error error: syntax error at or near "WITH" and I'm not sure exactly where the issue is. Does this query look right to you? Is this the right way to go about writing an efficient query? Note that because there are many findings I need to report, and this action happens often, it is probabably too slow to seperate out each finding insertion into a separate set of queries surrounded by a transaction. Doing it atomically will likely be much faster.

Answer 1

I was misunderstanding how those temporary "tables" work. You still need to select from them as you would a normal table. I also rolled the three named subqueries from the 'findings' insert into anonymous subqueries inside the values, much cleaner.

          WITH this_report AS (
            INSERT INTO public.reports(
                source_type, 
                target, 
                db_date,
                grype_version, 
                distro_name, 
                distro_version, 
                project_id)
            VALUES(
                 'directory',
                 '.',
                 '2022-01-16T00:15:11.000-08:00',
                 '0.28.0',
                 '',
                 '',
                 '53aca794-0e55-4d99-974c-f522bab414e1'
            ) RETURNING id
          )
          INSERT INTO findings(
            vulnerability_id,
            vulnerability_package_id,
            package_version_id,
            report_id,
            package_name,
            version,
            version_matcher,
            type,
            locations,
            language,
            purl,
            virtual_path,
            matcher
          ) VALUES (
            ( SELECT id FROM public.vulnerabilities WHERE slug = 'CVE-2008-0732:nvd' ),
            ( SELECT id FROM public.vulnerability_packages WHERE slug = 'CVE-2008-0732:nvd:geronimo-j2ee-management_1.1_spec'),
            ( SELECT id FROM public.package_versions WHERE slug = 'CVE-2008-0732:nvd:geronimo-j2ee-management_1.1_spec:none (unknown)'),
            ( SELECT id FROM this_report ),
            'geronimo-j2ee-management_1.1_spec',
            '1.0.1',
            'none (unknown)',
            'java-archive',
            array['tools/log4shell/test/vulnerable-services/zipkin-server-2.23.15-exec.jar'],
            'java',
            'pkg:maven/org.apache.geronimo.specs/geronimo-j2ee-management_1.1_spec@1.0.1',
            'tools/log4shell/test/vulnerable-services/zipkin-server-2.23.15-exec.jar:BOOT-INF/lib/geronimo-j2ee-management_1.1_spec-1.0.1.jar',
            'java-matcher'
          );