Skip to content

Close leaked sqlite3 connections (ResourceWarning on Python 3.13+) - #6181

Merged
stamparm merged 1 commit into
sqlmapproject:masterfrom
PiyushSatyarthi:fix/sqlite-connection-leaks
Nov 12, 2026
Merged

stamparm merged 1 commit into
sqlmapproject:masterfrom
PiyushSatyarthi:fix/sqlite-connection-leaks

Conversation

@PiyushSatyarthi

@PiyushSatyarthi PiyushSatyarthi commented Nov 12, 2026 •

Copy link
Copy Markdown
Contributor

On Python 3.13+, sqlite3 warns when a connection is garbage collected without being closed. Running the unit tests on Linux with CPython 3.14 prints more than 20 ResourceWarning: unclosed database lines. CI only runs 3.14 on Windows, so they don't show up there.

Most of the warnings come from the tests, but one is a real leak in sqlmap itself:

  • lib/utils/sqlalchemy.py: SQLAlchemy.close() (inherited from the generic connector) only returns the connection to the engine's pool. The underlying DBAPI connection stays open, for example the sqlite3 connection with -d sqlite://.... close() now also disposes the engine.
  • lib/core/testing.py: vulnTest() used with sqlite3.connect(...). sqlite3's context manager commits but does not close, so it now uses contextlib.closing() with an explicit commit.
  • tests/test_multibit.py, tests/test_sqlalchemy.py: close the connections the tests open.

Proof

Linux, CPython 3.14.7, python3 -B -W always::ResourceWarning -m unittest discover -s tests -p "test_*.py":

  • before: Ran 2751 tests ... OK (skipped=10), with 20+ unclosed database warnings
  • after: Ran 2751 tests ... OK (skipped=10), with no unclosed database warnings

The sqlalchemy.py change is what fixes the connector leak, not just the test cleanup. With only that file reverted, tests.test_sqlalchemy still warns even though the test calls sa.close():

$ python3 -B -W always::ResourceWarning -m unittest tests.test_sqlalchemy   # without the sqlalchemy.py change
OK
<sys>:0: ResourceWarning: unclosed database in <sqlite3.Connection object at 0x7fe2e5977d30>

$ python3 -B -W always::ResourceWarning -m unittest tests.test_sqlalchemy   # with it
OK

python3 -W always::ResourceWarning sqlmap.py --vuln-test (which runs the changed vulnTest() code) ends with vuln test final result: PASSED and no unclosed database warnings.

Python 3.13+ reports sqlite3 connections that are garbage collected
without being closed. The unit tests print a run of
"ResourceWarning: unclosed database" lines on Linux/CPython 3.14:

- SQLAlchemy.close() only returned its connection to the engine's
  pool, so the underlying DBAPI connection (e.g. sqlite3 for
  '-d sqlite://...') stayed open. Dispose the engine on close.
- vulnTest() used "with sqlite3.connect(...)", which commits but does
  not close the connection. Use contextlib.closing().
- test_multibit and test_sqlalchemy never closed what they opened.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings November 12, 2026 07:00

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

@stamparm
stamparm merged commit cb52165 into sqlmapproject:master Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants