feat(adapters): shared allow_* sensitive driver feature gates#514
Closed
cofin wants to merge 1 commit into
Closed
Conversation
Add `assert_sensitive_feature_enabled` + `SENSITIVE_FLAG_PREFIX` to `sqlspec/utils/config_tools.py` and route every security-sensitive driver feature through the shared `allow_*` opt-in convention. - asyncmy: refactor existing local_infile gate onto the shared helper - aiomysql: rename enable_local_infile -> allow_local_infile with a config-time raise (clean break, no alias) - pymysql: add allow_local_infile gate (local_infile=True now requires opt-in) - duckdb: gate CREATE PERSISTENT SECRET behind allow_persistent_secrets; prove the four sensitive flags are absent by default - arrow_odbc / mssql_python: default-off proof tests for trusted_connection / trust_server_certificate (no production change) - docs: Sensitive Driver Features section in docs/usage/configuration.rst Closes sqlspec-gdtl.1 (Tasks 1-8).
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #514 +/- ##
==========================================
- Coverage 74.44% 74.42% -0.02%
==========================================
Files 439 439
Lines 53490 53506 +16
Branches 8464 8465 +1
==========================================
+ Hits 39819 39821 +2
- Misses 11048 11055 +7
- Partials 2623 2630 +7
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Member
Author
|
Reverting: default-deny gating disabled core driver features (file reads, etc.) by default, which is the wrong default. Redesign needed — gating must be operator opt-in, default permissive. Reopening Beads epic sqlspec-gdtl.1. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First PR of the Adapter Feature Roadmap (
sqlspec-gdtl). Establishes a single, shared opt-in convention for security-sensitive driver features. Sensitive capabilities — local file reads, code/extension loading, persisted credentials, relaxed TLS trust — are now disabled by default and require an explicitallow_*flag inconnection_config; requesting one without the flag raisesImproperConfigurationErrornaming the exact flag.Implements the binding worksheet
adapter-feature-sensitive-driver-gates/spec.md, Tasks 1–8 (epicsqlspec-gdtl.1).Changes
sqlspec/utils/config_tools.py):assert_sensitive_feature_enabled(feature, requested, allowed, *, flag_name, risk)+SENSITIVE_FLAG_PREFIX = "allow_". mypyc-safe (builtins only); message format"{feature} requires {flag_name}=True because {risk}."reproduces the prior asyncmy message verbatim.local_infilegate refactored onto the helper (no behavior change; existing test passes unedited).enable_local_infile→allow_local_infilewith asyncmy-style two-gate raise at config construction. No alias/shim.allow_local_infilegate —local_infile=Truewithout the flag now raises.CREATE PERSISTENT SECRETgated behindallow_persistent_secrets(native key, forwarded not popped); proof tests that all four sensitive flags are absent by default.trusted_connection/trust_server_certificate(no production change — they were already emitted only when configured).docs/usage/configuration.rst.Validation
make lint— pre-commit, mypy, pyright, slotscheck all green.grep enable_local_infile sqlspec/ docs/returns nothing (only descriptive test-fn names remain).Follow-ups (unblocked by this PR)
This lands the shared helper that sibling flows consume:
allow_extension_loading(sqlite/aiosqlite), andallow_*cloud-billing gates (BigQuery/Spanner) — reserved here, implemented in their own flows.