91̽»¨

Behind the Scenes: Query Language Parsing

In this second part of the query language blog series, we look closely at the implementation of the lexer and parser.

In a previous blog post, we introduced 91̽»¨’s query language and how it can help you express specific targeting rules in complex environments. This blog post will look under the hood showing how the query language’s lexer and parser are implemented. We will learn how is leveraged to construct Java and JavaScript lexers and parsers.

Desired Syntax

The query language is mainly intended to identify/find targets to execute actions (attacks, checks…) against them. What are targets, though? For 91̽»¨, targets are observed hosts, Kubernetes workloads, API endpoints and more. Targets carry attributes, e.g., Kubernetes deployments carry the deployment name and the namespace in which they are deployed. When identifying and finding targets to attack or check, it is beneficial to have full access to all the attributes and boolean algebra.

Of course, there is no need to reinvent the wheel regarding query languages. There are many suitable and frequently used variants out there. Based on our experience and customers’ feedback, we were looking for a syntax similar to

• SQL where clauses, e.g., k8s.deployment=checkout AND k8s.namespace LIKE ‘dev-%’ or the
• , e.g., k8s.deployment:checkout AND k8s.namespace:dev*

In the end, we settled for a variation of SQL where clauses. Now, to parsing this syntax!

Generator Selection

We could parse the syntax through manually crafted code, but this would be error-prone, hard to maintain and generally tedious. On top of this, we would have to support a parser in Java and JavaScript. In contrast, several highly capable, commonly used and mature solutions for parsing text are available. is one of these solutions, and it is the one we chose.

ANTLR accepts lexer and parser grammars as input and generates lexers and parsers in various languages. Maven build plugins, IntelliJ IDE extensions, books, support articles, and more make ANTLR a good choice for simple and more advanced use cases.

The screenshot above depicts the IntelliJ IDEA ANTLR v4 plugin you can install through the marketplace. You can use the input field on the left to define a text that the plugin will parse. The image on the right side presents the parse tree (sometimes called abstract syntax tree). When working with an ANTLR-generated parser, you will work with the parse tree through an object hierarchy.

Lexer and Parser Grammars

Authoring lexer and parser grammars can be very complex. Much too complex for a blog post such as this. Lucky for us, our query language is based on existing query languages! Also, thanks to ANTLR’s popularity, there are a lot of open source grammars we can use as inspiration! An SQL lexer and parser would have been our second choice since it comes with many additional capabilities we do not need. Consequently, we looked for an open-source Lucene query language lexer and parser that we could modify for our needs.

ANTLR has a handy collection of open-source grammars within their repository. Among those, even an ! This enabled us to move more quickly and avoid common pitfalls, e.g., escaping, conjunction vs. disjunction precedence and parentheses logic. We adapted a few things here and there (using = instead of :), made the grammar more lenient (allowing lowercase AND and OR) and removed some syntax capabilities (number comparisons).

lexer grammar QueryLanguageLexer;

AND : 'AND' | 'and' | '&&';

OR : 'OR' | 'or' | '||';

NOT : 'NOT' | 'not' | '!';

The snippet above shows the first few lines of our lexer’s grammar. Most of it is still strikingly similar to the . The following snippet shows the first few lines of our parser’s grammar. Again, most of it is still similar to the .

parser grammar QueryLanguageParser;

options { tokenVocab=QueryLanguageLexer; }

topLevelQuery

  : query EOF

  ;

query

  : disjQuery?

  ;

disjQuery

  : conjQuery ( OR conjQuery )*

  ;

Generating the Lexer and Parser Code

With the scariest work out of the way, we can now turn back to a common problem: Build definitions. We leverage to build the component requiring the query language. Consequently, this is where we integrated the build steps.

The image above shows our query-language module. This module contains the grammars, build logic for the generated Java lexer and parser and some wrappers around the generated code. To generate the lexer and parser code, we use the antlr4-maven-plugin, as shown below.

<plugin>
 Ìý&±ô³Ù;²µ°ù´Ç³Ü±è±õ»å&²µ³Ù;´Ç°ù²µ.²¹²Ô³Ù±ô°ù&±ô³Ù;/²µ°ù´Ç³Ü±è±õ»å&²µ³Ù;
 Ìý&±ô³Ù;²¹°ù³Ù¾±´Ú²¹³¦³Ù±õ»å&²µ³Ù;²¹²Ô³Ù±ô°ù4-³¾²¹±¹±ð²Ô-±è±ô³Ü²µ¾±²Ô&±ô³Ù;/²¹°ù³Ù¾±´Ú²¹³¦³Ù±õ»å&²µ³Ù;
 Ìý&±ô³Ù;±¹±ð°ù²õ¾±´Ç²Ô&²µ³Ù;$µ÷²¹²Ô³Ù±ô°ù.±¹±ð°ù²õ¾±´Ç²Ô°¨&±ô³Ù;/±¹±ð°ù²õ¾±´Ç²Ô&²µ³Ù;
 Ìý&±ô³Ù;³¦´Ç²Ô´Ú¾±²µ³Ü°ù²¹³Ù¾±´Ç²Ô&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;±¹¾±²õ¾±³Ù´Ç°ù&²µ³Ù;³Ù°ù³Ü±ð&±ô³Ù;/±¹¾±²õ¾±³Ù´Ç°ù&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;±ô¾±²õ³Ù±ð²Ô±ð°ù&²µ³Ù;³Ù°ù³Ü±ð&±ô³Ù;/±ô¾±²õ³Ù±ð²Ô±ð°ù&²µ³Ù;
 Ìý&±ô³Ù;/³¦´Ç²Ô´Ú¾±²µ³Ü°ù²¹³Ù¾±´Ç²Ô&²µ³Ù;
ÌýÌý&±ô³Ù;±ð³æ±ð³¦³Ü³Ù¾±´Ç²Ô²õ&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;±ð³æ±ð³¦³Ü³Ù¾±´Ç²Ô&²µ³Ù;
 ÌýÌýÌýÌýÌý&±ô³Ù;²µ´Ç²¹±ô²õ&²µ³Ù;
 ÌýÌýÌýÌýÌýÌýÌý&±ô³Ù;²µ´Ç²¹±ô&²µ³Ù;²¹²Ô³Ù±ô°ù4&±ô³Ù;/²µ´Ç²¹±ô&²µ³Ù;
 ÌýÌýÌýÌýÌý&±ô³Ù;/²µ´Ç²¹±ô²õ&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;/±ð³æ±ð³¦³Ü³Ù¾±´Ç²Ô&²µ³Ù;
ÌýÌý&±ô³Ù;/±ð³æ±ð³¦³Ü³Ù¾±´Ç²Ô²õ&²µ³Ù;
</plugin>

This Maven build plugin generates additional sources within the target directory, as shown in the picture below. You will learn how to use these generated sources in the next section.

As the last build step, we must construct a JavaScript lexer and parser implementation. You can also achieve this through the Maven build plugin (we do this from another Maven module that wraps the UI sources).

<plugin>
 Ìý&±ô³Ù;²µ°ù´Ç³Ü±è±õ»å&²µ³Ù;´Ç°ù²µ.²¹²Ô³Ù±ô°ù&±ô³Ù;/²µ°ù´Ç³Ü±è±õ»å&²µ³Ù;
 Ìý&±ô³Ù;²¹°ù³Ù¾±´Ú²¹³¦³Ù±õ»å&²µ³Ù;²¹²Ô³Ù±ô°ù4-³¾²¹±¹±ð²Ô-±è±ô³Ü²µ¾±²Ô&±ô³Ù;/²¹°ù³Ù¾±´Ú²¹³¦³Ù±õ»å&²µ³Ù;
 Ìý&±ô³Ù;±¹±ð°ù²õ¾±´Ç²Ô&²µ³Ù;$µ÷²¹²Ô³Ù±ô°ù.±¹±ð°ù²õ¾±´Ç²Ô°¨&±ô³Ù;/±¹±ð°ù²õ¾±´Ç²Ô&²µ³Ù;
 Ìý&±ô³Ù;±ð³æ±ð³¦³Ü³Ù¾±´Ç²Ô²õ&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;±ð³æ±ð³¦³Ü³Ù¾±´Ç²Ô&²µ³Ù;
 ÌýÌýÌýÌýÌý&±ô³Ù;¾±»å&²µ³Ù;²¹²Ô³Ù±ô°ù4&±ô³Ù;/¾±»å&²µ³Ù;
 ÌýÌýÌýÌýÌý&±ô³Ù;²µ´Ç²¹±ô²õ&²µ³Ù;
 ÌýÌýÌýÌýÌýÌýÌý&±ô³Ù;²µ´Ç²¹±ô&²µ³Ù;²¹²Ô³Ù±ô°ù4&±ô³Ù;/²µ´Ç²¹±ô&²µ³Ù;
 ÌýÌýÌýÌýÌý&±ô³Ù;/²µ´Ç²¹±ô²õ&²µ³Ù;
 ÌýÌýÌýÌýÌý&±ô³Ù;±è³ó²¹²õ±ð&²µ³Ù;²µ±ð²Ô±ð°ù²¹³Ù±ð-°ù±ð²õ´Ç³Ü°ù³¦±ð²õ&±ô³Ù;/±è³ó²¹²õ±ð&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;/±ð³æ±ð³¦³Ü³Ù¾±´Ç²Ô&²µ³Ù;
 Ìý&±ô³Ù;/±ð³æ±ð³¦³Ü³Ù¾±´Ç²Ô²õ&²µ³Ù;
 Ìý&±ô³Ù;³¦´Ç²Ô´Ú¾±²µ³Ü°ù²¹³Ù¾±´Ç²Ô&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;±¹¾±²õ¾±³Ù´Ç°ù&²µ³Ù;³Ù°ù³Ü±ð&±ô³Ù;/±¹¾±²õ¾±³Ù´Ç°ù&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;±ô¾±²õ³Ù±ð²Ô±ð°ù&²µ³Ù;³Ù°ù³Ü±ð&±ô³Ù;/±ô¾±²õ³Ù±ð²Ô±ð°ù&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;²õ´Ç³Ü°ù³¦±ð¶Ù¾±°ù±ð³¦³Ù´Ç°ù²â&²µ³Ù;../±ç³Ü±ð°ù²â-±ô²¹²Ô²µ³Ü²¹²µ±ð/²õ°ù³¦/³¾²¹¾±²Ô/²¹²Ô³Ù±ô°ù4/³¦´Ç³¾/²õ³Ù±ð²¹»å²â²ú¾±³Ù/±ç±ô&±ô³Ù;/²õ´Ç³Ü°ù³¦±ð¶Ù¾±°ù±ð³¦³Ù´Ç°ù²â&²µ³Ù;
ÌýÌýÌýÌý&±ô³Ù;´Ç³Ü³Ù±è³Ü³Ù¶Ù¾±°ù±ð³¦³Ù´Ç°ù²â&²µ³Ù;²õ°ù³¦/±ç³Ü±ð°ù²â³¢²¹²Ô²µ³Ü²¹²µ±ð/±è²¹°ù²õ±ð°ù/²µ±ð²Ô±ð°ù²¹³Ù±ð»å&±ô³Ù;/´Ç³Ü³Ù±è³Ü³Ù¶Ù¾±°ù±ð³¦³Ù´Ç°ù²â&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;²¹°ù²µ³Ü³¾±ð²Ô³Ù²õ&²µ³Ù;
 ÌýÌýÌýÌýÌý&±ô³Ù;²¹°ù²µ³Ü³¾±ð²Ô³Ù&²µ³Ù;-¶Ù±ô²¹²Ô²µ³Ü²¹²µ±ð=´³²¹±¹²¹³§³¦°ù¾±±è³Ù&±ô³Ù;/²¹°ù²µ³Ü³¾±ð²Ô³Ù&²µ³Ù;
 ÌýÌýÌý&±ô³Ù;/²¹°ù²µ³Ü³¾±ð²Ô³Ù²õ&²µ³Ù;
 Ìý&±ô³Ù;/³¦´Ç²Ô´Ú¾±²µ³Ü°ù²¹³Ù¾±´Ç²Ô&²µ³Ù;
</plugin>

Intermediate Summary

Let us quickly summarize what we got at this point before we carry on. We got a lexer implementation in both Java and JavaScript that can turn a character sequence into a token sequence (QueryLanguageLexer). A token sequence is still too low-level for us to work with. We also got a parser implementation in both languages that can turn the token sequence into a parse tree (QueryLanguageParser). Parse trees encapsulate a lot of the semantics of our query language, and we can work with these going forward. To aid development, ANTLR also generated a visitor interface (QueryLanguageParserVisitor) that we can implement to traverse the parse tree.

Usage in Java

What you do with the generated lexer and parser is up to you. Our main objective is to translate the generated parse tree into an object hierarchy compatible with the existing code base. To achieve this, we use the generated lexer, parser and visitor, as the code snippet below alludes.

package com.steadybit.ql;
import com.steadybit.ql.model.Clause;
import org.antlr.v4.runtime.CharStreams;
import org.antlr.v4.runtime.CommonTokenStream;

private QueryLanguageParser toParser(String query) {
  var input = CharStreams.fromString(query);
  var errorListener = new ErrorListener();
  var lexer = new QueryLanguageLexer(input);
 Ìý±ô±ð³æ±ð°ù.²¹»å»å·¡°ù°ù´Ç°ù³¢¾±²õ³Ù±ð²Ô±ð°ù(±ð°ù°ù´Ç°ù³¢¾±²õ³Ù±ð²Ô±ð°ù);
  var tokens = new CommonTokenStream(lexer);
  var parser = new QueryLanguageParser(tokens);

  // remove the default error to stderr listener
 Ìý±è²¹°ù²õ±ð°ù.°ù±ð³¾´Ç±¹±ð·¡°ù°ù´Ç°ù³¢¾±²õ³Ù±ð²Ô±ð°ù²õ();
 Ìý±è²¹°ù²õ±ð°ù.²¹»å»å·¡°ù°ù´Ç°ù³¢¾±²õ³Ù±ð²Ô±ð°ù(±ð°ù°ù´Ç°ù³¢¾±²õ³Ù±ð²Ô±ð°ù);
  return parser;
}

public Clause toClause(String query) {
  return toParser(query)
 ÌýÌýÌýÌýÌýÌýÌýÌýÌý.³Ù´Ç±è³¢±ð±¹±ð±ô²Ï³Ü±ð°ù²â()
          .accept(new QueryToClauseTransformationVisitor());
}

Usage in JavaScript

The nice thing about the generated ANTLR code is the API similarity across languages. The JavaScript API and the generated code’s usage are very similar to the Java variant. The following code snippet shows how you can combine the lexer, parser and visitor with the .

import antlr4 from "antlr4";
import QueryLanguageParser from "./generated/QueryLanguageParser";
import { QueryLanguageToTargetPredicateVisitor } from "./visitor";
import QueryLanguageLexer from "./generated/QueryLanguageLexer";
import { QueryLanguageErrorListener } from "./errorListener";
import { isParsingError, ParsingResult } from "./types";
export function toTargetPredicate(input: string): ParsingResult {
  try {
    const chars = new antlr4.InputStream(input);
    const lexer = new QueryLanguageLexer(chars);
    lexer.addErrorListener(new QueryLanguageErrorListener());
    const tokens = new antlr4.CommonTokenStream(lexer);
    const parser = new QueryLanguageParser(tokens);
    parser.buildParseTrees = true;
    // remove the default error to console.error listener
   Ìý±è²¹°ù²õ±ð°ù.°ù±ð³¾´Ç±¹±ð·¡°ù°ù´Ç°ù³¢¾±²õ³Ù±ð²Ô±ð°ù²õ();
    parser.addErrorListener(new QueryLanguageErrorListener());
    const tree = parser.topLevelQuery();
    return (
      tree.accept(new QueryLanguageToTargetPredicateVisitor()) ?? {
        operator: "AND",
        predicates: [],
 ÌýÌýÌýÌýÌý°¨
 ÌýÌýÌý);
 Ìý°¨ catch (e) {
    if (isParsingError(e)) {
      return e;
 ÌýÌýÌý°¨ else {
      return {
        message: e.message,
        line: 1,
        column: 1,
 ÌýÌýÌýÌýÌý°¨;
 ÌýÌýÌý°¨
 Ìý°¨
}

Conclusion

We saw how an existing query language could be used as a starting point for a new query language using ANTLR. This exercise results in a query language with parsers in both Java and JavaScript. This query language is now ready to be integrated with the rest of the product.

In a future article, we will dive deeper into the JavaScript parser usage, specifically how we integrated the parser with the !