Skip to content

🛡️ Sentinel: [CRITICAL] Fix SQL injection risk in dynamic kwargs#53

Draft
davidjuarezdev wants to merge 1 commit intomainfrom
sentinel/fix-sql-injection-kwargs-1275855855781349914
Draft

🛡️ Sentinel: [CRITICAL] Fix SQL injection risk in dynamic kwargs#53
davidjuarezdev wants to merge 1 commit intomainfrom
sentinel/fix-sql-injection-kwargs-1275855855781349914

Conversation

@davidjuarezdev
Copy link
Copy Markdown
Owner

🚨 Severity: CRITICAL
💡 Vulnerability: The contains and remove database methods accept **kwargs that unpack directly into SQL condition strings. The validation of these columns was previously done with an assert. If a user runs streamrip using the python optimize flag (-O), assertions are stripped, allowing arbitrary column names to be unpacked into dynamic SQL queries, completely bypassing the validation.
🎯 Impact: Exploitation could allow an attacker to inject arbitrary SQL statements into the database query engine.
🔧 Fix: Removed assert validation and replaced it with an explicit ValueError that cannot be ignored by the interpreter. Also added the missing dictionary key validation to the remove method.
✅ Verification: Ran the test suite via poetry run pytest tests to ensure no legitimate internal database query mechanisms break from the stricter validation checking.

Includes a journal entry to .jules/sentinel.md documenting the learnings of this vulnerability constraint.


PR created automatically by Jules for task 1275855855781349914 started by @davidjuarezdev

Replaces assert with explicit ValueError key validation to prevent SQL injection in streamrip/db.py when kwargs are unpacked into dynamic SQL queries. Asserts can be optimized away.

Co-authored-by: davidjuarezdev <230496599+davidjuarezdev@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant