Repository navigation
sqlite3.Connection(...) bypasses 'sqlite3.connect' audit hooks #87600
Description
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = <Date 2021-05-02.22:56:58.153>
created_at = <Date 2021-03-08.12:53:59.903>
labels = ['type-security', '3.8', 'library', '3.9', '3.10']
title = "sqlite3.Connection(...) bypasses 'sqlite3.connect' audit hooks"
updated_at = <Date 2021-05-02.22:56:58.152>
user = 'https://github.com/erlend-aasland'bugs.python.org fields:
activity = <Date 2021-05-02.22:56:58.152>
actor = 'steve.dower'
assignee = 'none'
closed = True
closed_date = <Date 2021-05-02.22:56:58.153>
closer = 'steve.dower'
components = ['Library (Lib)']
creation = <Date 2021-03-08.12:53:59.903>
creator = 'erlendaasland'
dependencies = []
files = ['49857', '49858']
hgrepos = []
issue_num = 43434
keywords = ['patch']
message_count = 13.0
messages = ['388264', '392393', '392702', '392709', '392724', '392735', '392736', '392737', '392742', '392743', '392745', '392748', '392749']
nosy_count = 4.0
nosy_names = ['berker.peksag', 'steve.dower', 'miss-islington', 'erlendaasland']
pr_nums = ['25818', '25822', '25823', '25825', '25826']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue43434'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']
Activity
erlend-aasland commentedon Mar 8, 2021
The module level connect method is guarded by PySys_Audit(), but sqlite3.Connection.__init__() is not. It is possible to bypass the module level connect() method simply by creating a new sqlite3.Connection object directly.
Easily fixed by either moving the PySys_Audit() check to pysqlite_connection_init(), or by adding an extra check in pysqlite_connection_init().
erlend-aasland commentedon Apr 30, 2021
Steve, is it worth it to improve this?
zooba commentedon May 2, 2021
Yes, let's move it into the init function.
erlend-aasland commentedon May 2, 2021
The PR accidentally fixes a bug in #69433 (bpo-43762):
The object passed to PySys_Audit() is now the connection object, not the module object.
erlend-aasland commentedon May 2, 2021
Steve, can we get this in before beta1 (bco. the bugfix)?
zooba commentedon May 2, 2021
New changeset c96cc08 by Erlend Egeberg Aasland in branch 'master':
bpo-43434: Move sqlite3.connect audit events to sqlite3.Connection.__init__ (GH-25818)
c96cc08
zooba commentedon May 2, 2021
We could get this one in after beta 1 anyway, but sure, it's in.
The backports are going to have to be manual, I suspect...
erlend-aasland commentedon May 2, 2021
Thanks! :) I'll fix the backports.
zooba commentedon May 2, 2021
Thanks, Erlend! Appreciate how quickly you got onto that, and the quality of your work.
zooba commentedon May 2, 2021
New changeset cbb7b9e by Erlend Egeberg Aasland in branch 'master':
bpo-43434: Clean up sqlite3.connect() after #70004 (GH-25823)
cbb7b9e
erlend-aasland commentedon May 2, 2021
Thanks, Steve, that means a lot! Glad to help. Thank you for getting it into beta1. Having the new event out there with the wrong object passed to it would have been a tiny bit embarrassing :)
zooba commentedon May 2, 2021
New changeset ad73d16 by Erlend Egeberg Aasland in branch '3.9':
bpo-43434: Move sqlite3.connect audit event to sqlite3.Connection.__init__ (GH-25818)
ad73d16
zooba commentedon May 2, 2021
New changeset 10665ac by Erlend Egeberg Aasland in branch '3.8':
bpo-43434: Move sqlite3.connect audit events to sqlite3.Connection.__init__ (GH-25818)
10665ac