feat(forward): apply DDL to a database — SECURITY REVIEW REQUIRED#464
Open
seonghobae wants to merge 1 commit into
Open
feat(forward): apply DDL to a database — SECURITY REVIEW REQUIRED#464seonghobae wants to merge 1 commit into
seonghobae wants to merge 1 commit into
Conversation
…ult)
Standalone against main. Forward engineering (model -> DB). POST /api/connections/{uuid}/apply-sql runs DDL in ONE transaction; dry_run=True (default) rolls back as a pre-flight, dry_run=False commits. Editor role, IDOR-safe (non-member 404, member-without-editor 403), SSRF-guarded via validate_postgres_dsn_target + pinned IP, DSN-redacted errors. PostgreSQL only. +7 tests. SECURITY REVIEW REQUIRED before merge (writes to a live DB).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AxU2xaupAjp912oDNFuWyd
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| tx = conn.transaction() | ||
| await tx.start() | ||
| try: | ||
| await conn.execute(sql) |
Collaborator
Author
There was a problem hiding this comment.
Intentional and documented, not an injection defect: this endpoint's purpose is executing caller-supplied DDL (forward engineering), which is why the PR is titled SECURITY REVIEW REQUIRED and excluded from auto-merge. Mitigations in place: editor-role + IDOR gates, SSRF-pinned connection, single transaction with dry-run-by-default rollback, DSN-redacted errors. Open questions for the human reviewer are listed in the PR body (restrict to server-generated migrations only / statement allow-list / audit+rate limits).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Independent PR against
main(replaces #458, which was needlessly stacked onadhesive-piper).POST /api/connections/{uuid}/apply-sql, body{ sql, dry_run=true }.dry_run=falseto persist.apply_postgres_sqlreusesvalidate_postgres_dsn_target+ pinned IP.ok=false.Open questions: arbitrary-SQL vs server-generated-migration-only; statement allow/deny-list; rate-limit + audit. backend
pytest+7 (IDOR/editor gates, dry-run paths, dialect dispatch, DSN redaction); mypy clean.🤖 Generated with Claude Code