remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-14 20:44:07 +02:00
Code Issues Projects Releases Packages Wiki Activity

Reject untrusted table-valued PRAGMA reads

Browse source
This commit is contained in:
Simon Willison 2026-09-08 21:16:35 -07:00
commit 8b10f58e1b
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
datasette/write_sql.py
View file

@ -83,6 +83,22 @@ def decision_for_write_sql_operation(
)
if operation.operation == "function":
return IgnoreWriteSqlOperation("SQL function")
if (
operation.operation == "read"
and operation.target_type == "table"
and operation.table is not None
and operation.table_kind is None
and operation.table.lower().startswith("pragma_")
):
# Eponymous table-valued PRAGMA functions (e.g. pragma_table_info("secret"))
# report a read of the synthetic "pragma_table_info" table, not of the
# table passed as an argument. That means a view-table denial on the real
# table is never consulted, so these could otherwise be used to read
# schema metadata (column names, table lists, ...) for tables the actor
# is not allowed to view. Reject them outright in untrusted write SQL,
# including inside CREATE VIEW bodies (whose reads are discovered here
# via the rolled-back dependency-read analysis above).
return UnsupportedWriteSqlOperation(unsupported_message)
if (
operation.operation == "read"
and operation.target_type == "table"