Add configurable grouping token limit

sqlparse/__init__.py

@@ -17,6 +17,17 @@
 __all__ = ["cli", "engine", "filters", "formatter", "sql", "tokens"]
 
 
+def set_max_grouping_tokens(limit: int | None) -> None:
+    """Set the maximum token count allowed during grouping.
+
+    Set *limit* to ``None`` to disable the token-count guard. Disabling or
+    increasing this limit is not recommended for SQL from untrusted sources.
+    """
+    if limit is not None and limit < 1:
+        raise ValueError("Grouping token limit must be a positive integer or None")
+    engine.grouping.MAX_GROUPING_TOKENS = limit
+
+
 def parse(
     sql: str, encoding: str | None = None
 ) -> tuple[sql.Statement, ...]:

tests/test_grouping_limits.py

@@ -0,0 +1,37 @@
+import pytest
+
+import sqlparse
+from sqlparse.engine import grouping
+from sqlparse.exceptions import SQLParseError
+
+
+def test_set_max_grouping_tokens_updates_grouping_limit():
+    original_limit = grouping.MAX_GROUPING_TOKENS
+    try:
+        sqlparse.set_max_grouping_tokens(20000)
+        assert grouping.MAX_GROUPING_TOKENS == 20000
+
+        sqlparse.set_max_grouping_tokens(None)
+        assert grouping.MAX_GROUPING_TOKENS is None
+    finally:
+        grouping.MAX_GROUPING_TOKENS = original_limit
+
+
+def test_set_max_grouping_tokens_rejects_nonpositive_limit():
+    with pytest.raises(ValueError, match="positive integer or None"):
+        sqlparse.set_max_grouping_tokens(0)
+
+
+def test_set_max_grouping_tokens_controls_parser_guard():
+    original_limit = grouping.MAX_GROUPING_TOKENS
+    statement = "SELECT " + ", ".join(f"column_{i}" for i in range(20))
+
+    try:
+        sqlparse.set_max_grouping_tokens(5)
+        with pytest.raises(SQLParseError, match="Maximum number of tokens exceeded"):
+            sqlparse.parse(statement)
+
+        sqlparse.set_max_grouping_tokens(100)
+        assert len(sqlparse.parse(statement)) == 1
+    finally:
+        grouping.MAX_GROUPING_TOKENS = original_limit