query_console 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9ea5d214eb67f13c153578fce1f001109518b6935409774d9ae343de3ee87258
-  data.tar.gz: e7f2c6c7a528ababbef441b2d548cc635222701f5903cbdd1f06b9ecbefd3bc8
+  metadata.gz: 19231f63422842fbe797464f96c6208d308ec868d8cb19872cceabd32a132c1a
+  data.tar.gz: edeedcb088b35135eabb6b4a445b315832ce0a500424f7718d84300dcfb3e08d
 SHA512:
-  metadata.gz: 5780f01ddfc86f3f998ea7f67b449ff312c3e4e305a6a5c454593a9aec6d691879837171d0567d2db8def6b70503d77203eecf708e4878947463b9f0443ba5eb
-  data.tar.gz: 99f44e0e10f2c06cb428936bfeaf8757bef817353d535ef1088761c6df7ea6a546905ce12c076207a5252103ce7df37a487ff56846a7e89d92c9e37e376de813
+  metadata.gz: be36ac0c732088e1fc1a683b435dc50597791fe5a46fe917c116de1464f34aa378f70701a09095a52bd677ee6b0b94f5fe758be4e302a1af0ae6d3697f5337a1
+  data.tar.gz: 9f5610145cb80d7557c5eb86f1655fb07483397e05616667a450a0b575ffd3c082728795b54c0db189a58dfe12bc46aeb46cdfa3d51ce33c20bbc6dd2321b513

data/app/controllers/query_console/explain_controller.rb

@@ -1,7 +1,5 @@
 module QueryConsole
   class ExplainController < ApplicationController
-    skip_forgery_protection only: [:create] # Allow Turbo Frame POST requests
-
     def create
       sql = params[:sql]
 

data/app/controllers/query_console/queries_controller.rb

@@ -1,7 +1,5 @@
 module QueryConsole
   class QueriesController < ApplicationController
-    skip_forgery_protection only: [:run] # Allow Turbo Frame POST requests
-    
     def new
       # Render the main query editor page
     end
@@ -18,6 +16,27 @@ module QueryConsole
         return
       end
 
+      # SECURITY FIX: Server-side DML confirmation check
+      # Validate DML confirmation before execution
+      config = QueryConsole.configuration
+      if config.enable_dml
+        # Quick check if SQL contains DML keywords
+        normalized_sql = sql.strip.downcase
+        if normalized_sql.match?(/\A(insert|update|delete|merge)\b/)
+          # This is a DML query - require confirmation
+          unless params[:dml_confirmed] == 'true'
+            @result = Runner::QueryResult.new(
+              error: "DML query execution requires user confirmation. Please confirm the operation to proceed."
+            )
+            respond_to do |format|
+              format.turbo_stream { render turbo_stream: turbo_stream.replace("query-results", partial: "results", locals: { result: @result, is_dml: false }) }
+              format.html { render :_results, layout: false }
+            end
+            return
+          end
+        end
+      end
+
       # Execute the query
       runner = Runner.new(sql)
       @result = runner.execute

data/app/services/query_console/audit_logger.rb

@@ -39,17 +39,33 @@ module QueryConsole
     end
 
     def self.is_dml_query?(sql)
-      sql.to_s.strip.downcase.match?(/\A(insert|update|delete|merge)\b/)
+      normalized = sql.to_s.strip.downcase
+      # Check if it's a top-level DML query
+      is_top_level = normalized.match?(/\A(insert|update|delete|merge)\b/)
+      # SECURITY FIX: Also check for DML anywhere in the query (subqueries)
+      has_dml_anywhere = normalized.match?(/\b(insert|update|delete|merge)\b/)
+      
+      # Return true if DML detected anywhere (for audit purposes)
+      is_top_level || has_dml_anywhere
     end
 
     def self.determine_query_type(sql)
-      case sql.to_s.strip.downcase
+      normalized = sql.to_s.strip.downcase
+      
+      # SECURITY FIX: Check for DML anywhere in query, not just at start
+      # This ensures subquery DML is properly logged
+      if normalized.match?(/\b(insert|update|delete|merge)\b/)
+        # Determine which DML operation (prefer top-level, but detect any)
+        return "INSERT" if normalized.match?(/\binsert\b/)
+        return "UPDATE" if normalized.match?(/\bupdate\b/)
+        return "DELETE" if normalized.match?(/\bdelete\b/)
+        return "MERGE" if normalized.match?(/\bmerge\b/)
+      end
+      
+      # If no DML, check for SELECT/WITH
+      case normalized
       when /\Aselect\b/ then "SELECT"
       when /\Awith\b/ then "WITH"
-      when /\Ainsert\b/ then "INSERT"
-      when /\Aupdate\b/ then "UPDATE"
-      when /\Adelete\b/ then "DELETE"
-      when /\Amerge\b/ then "MERGE"
       else "UNKNOWN"
       end
     end

data/app/services/query_console/explain_runner.rb

@@ -96,6 +96,49 @@ module QueryConsole
     end
 
     def execute_with_timeout(sql)
+      case @config.timeout_strategy
+      when :database
+        execute_with_database_timeout(sql)
+      when :ruby
+        execute_with_ruby_timeout(sql)
+      else
+        # Auto-detect: use database timeout for PostgreSQL, Ruby timeout otherwise
+        if postgresql_connection?
+          execute_with_database_timeout(sql)
+        else
+          execute_with_ruby_timeout(sql)
+        end
+      end
+    end
+
+    # Database-level timeout (PostgreSQL only)
+    # Safer: database cancels the query cleanly, no orphan processes
+    def execute_with_database_timeout(sql)
+      conn = ActiveRecord::Base.connection
+      
+      unless postgresql_connection?
+        Rails.logger.warn("[QueryConsole] Database timeout strategy requires PostgreSQL, falling back to Ruby timeout")
+        return execute_with_ruby_timeout(sql)
+      end
+
+      conn.transaction do
+        # SET LOCAL scopes the timeout to this transaction only
+        conn.execute("SET LOCAL statement_timeout = '#{@config.timeout_ms}'")
+        conn.exec_query(sql)
+      end
+    rescue ActiveRecord::StatementInvalid => e
+      if e.message.include?("canceling statement due to statement timeout") ||
+         e.message.include?("query_canceled")
+        raise Timeout::Error, "Query timeout: exceeded #{@config.timeout_ms}ms limit"
+      else
+        raise
+      end
+    end
+
+    # Ruby-level timeout (fallback for non-PostgreSQL databases)
+    # Warning: The database query continues running as an orphan process
+    # even after Ruby times out. Can cause resource exhaustion.
+    def execute_with_ruby_timeout(sql)
       timeout_seconds = @config.timeout_ms / 1000.0
       
       Timeout.timeout(timeout_seconds) do
@@ -103,6 +146,10 @@ module QueryConsole
       end
     end
 
+    def postgresql_connection?
+      ActiveRecord::Base.connection.adapter_name.downcase.include?('postgresql')
+    end
+
     def format_explain_output(result)
       # For SQLite, the result has columns like: id, parent, notused, detail
       # For Postgres, it's usually a single "QUERY PLAN" column

data/app/services/query_console/runner.rb

@@ -94,6 +94,49 @@ module QueryConsole
     attr_reader :sql, :config
 
     def execute_with_timeout(sql)
+      case @config.timeout_strategy
+      when :database
+        execute_with_database_timeout(sql)
+      when :ruby
+        execute_with_ruby_timeout(sql)
+      else
+        # Auto-detect: use database timeout for PostgreSQL, Ruby timeout otherwise
+        if postgresql_connection?
+          execute_with_database_timeout(sql)
+        else
+          execute_with_ruby_timeout(sql)
+        end
+      end
+    end
+
+    # Database-level timeout (PostgreSQL only)
+    # Safer: database cancels the query cleanly, no orphan processes
+    def execute_with_database_timeout(sql)
+      conn = ActiveRecord::Base.connection
+      
+      unless postgresql_connection?
+        Rails.logger.warn("[QueryConsole] Database timeout strategy requires PostgreSQL, falling back to Ruby timeout")
+        return execute_with_ruby_timeout(sql)
+      end
+
+      conn.transaction do
+        # SET LOCAL scopes the timeout to this transaction only
+        conn.execute("SET LOCAL statement_timeout = '#{@config.timeout_ms}'")
+        conn.exec_query(sql)
+      end
+    rescue ActiveRecord::StatementInvalid => e
+      if e.message.include?("canceling statement due to statement timeout") ||
+         e.message.include?("query_canceled")
+        raise Timeout::Error, "Query timeout: exceeded #{@config.timeout_ms}ms limit"
+      else
+        raise
+      end
+    end
+
+    # Ruby-level timeout (fallback for non-PostgreSQL databases)
+    # Warning: The database query continues running as an orphan process
+    # even after Ruby times out. Can cause resource exhaustion.
+    def execute_with_ruby_timeout(sql)
       timeout_seconds = @config.timeout_ms / 1000.0
       
       Timeout.timeout(timeout_seconds) do
@@ -101,6 +144,10 @@ module QueryConsole
       end
     end
 
+    def postgresql_connection?
+      ActiveRecord::Base.connection.adapter_name.downcase.include?('postgresql')
+    end
+
     # Get the number of rows affected by a DML query
     # This is database-specific, so we try different approaches
     def get_affected_rows_count(result)

data/app/services/query_console/sql_validator.rb

@@ -67,11 +67,24 @@ module QueryConsole
       # Check for forbidden keywords
       normalized_query = sanitized.downcase
       
-      # Filter forbidden keywords based on DML enablement
-      effective_forbidden = if @config.enable_dml
-        @config.forbidden_keywords.reject { |kw| dml_keywords.include?(kw) || kw == 'replace' || kw == 'into' }
+      # SECURITY FIX: When DML is enabled, we still need to prevent DML in subqueries
+      # Only allow DML at the top level (start of query)
+      if @config.enable_dml
+        # Check if this is a top-level DML query
+        is_top_level_dml = normalized_start.match?(/\A(insert|update|delete|merge)\b/)
+        
+        # If DML keywords appear anywhere else (subqueries, CTEs), block them
+        if !is_top_level_dml && normalized_query.match?(/\b(insert|update|delete|merge)\b/)
+          return ValidationResult.new(
+            valid: false,
+            error: "DML keywords (INSERT, UPDATE, DELETE, MERGE) are not allowed in subqueries or WITH clauses"
+          )
+        end
+        
+        # Filter forbidden keywords - only remove DML from forbidden list for top-level queries
+        effective_forbidden = @config.forbidden_keywords.reject { |kw| dml_keywords.include?(kw) || kw == 'replace' || kw == 'into' }
       else
-        @config.forbidden_keywords
+        effective_forbidden = @config.forbidden_keywords
       end
       
       forbidden = effective_forbidden.find do |keyword|
@@ -86,7 +99,7 @@ module QueryConsole
         )
       end
 
-      # Detect if this is a DML query
+      # Detect if this is a DML query (top-level only)
       is_dml_query = sanitized.downcase.match?(/\A(insert|update|delete|merge)\b/)
 
       ValidationResult.new(valid: true, sanitized_sql: sanitized, is_dml: is_dml_query)

data/app/views/query_console/queries/new.html.erb

@@ -595,12 +595,21 @@
         // Create form with Turbo Frame target
         const form = document.createElement('form')
         form.method = 'POST'
-        form.action = '<%= query_console.run_path %>'
+        form.action = '<%= run_path %>'
         form.setAttribute('data-turbo-frame', 'query-results')
-        form.innerHTML = `
+        
+        // SECURITY FIX: Add dml_confirmed parameter for server-side verification
+        let formHTML = `
           <input type="hidden" name="sql" value="${this.escapeHtml(sql)}">
           <input type="hidden" name="authenticity_token" value="${document.querySelector('meta[name=csrf-token]').content}">
         `
+        
+        // If DML query was confirmed, add confirmation parameter
+        if (this.isDmlQuery(sql)) {
+          formHTML += `<input type="hidden" name="dml_confirmed" value="true">`
+        }
+        
+        form.innerHTML = formHTML
         document.body.appendChild(form)
         form.requestSubmit()
         document.body.removeChild(form)
@@ -622,7 +631,7 @@
         // Create form with Turbo Frame target
         const form = document.createElement('form')
         form.method = 'POST'
-        form.action = '<%= query_console.explain_path %>'
+        form.action = '<%= explain_path %>'
         form.setAttribute('data-turbo-frame', 'explain-results')
         form.innerHTML = `
           <input type="hidden" name="sql" value="${this.escapeHtml(sql)}">
@@ -651,7 +660,7 @@
       
       async loadTables() {
         try {
-          const response = await fetch('<%= query_console.schema_tables_path %>')
+          const response = await fetch('<%= schema_tables_path %>')
           this.tables = await response.json()
           this.renderTables()
         } catch (error) {
@@ -680,7 +689,7 @@
         const tableName = event.currentTarget.dataset.tableName
         
         try {
-          const response = await fetch(`<%= query_console.schema_tables_path %>/${tableName}`)
+          const response = await fetch(`<%= schema_tables_path %>/${tableName}`)
           const tableData = await response.json()
           this.renderTableDetails(tableData)
         } catch (error) {
@@ -790,7 +799,7 @@
           history.map((item, index) => `
             <li data-action="click->history#load" data-index="${index}">
               <div style="font-size: 12px; color: #6c757d;">${new Date(item.timestamp).toLocaleString()}</div>
-              <div style="font-size: 13px; margin-top: 4px;">${this.truncate(item.sql, 100)}</div>
+              <div style="font-size: 13px; margin-top: 4px;">${this.escapeHtml(this.truncate(item.sql, 100))}</div>
             </li>
           `).join('') :
           '<li style="color: #6c757d; text-align: center; padding: 20px;">No query history</li>'
@@ -830,6 +839,13 @@
         localStorage.setItem(this.storageKeyValue, JSON.stringify(history))
       }
       
+      // SECURITY FIX: Escape HTML to prevent XSS
+      escapeHtml(text) {
+        const div = document.createElement('div')
+        div.textContent = text
+        return div.innerHTML
+      }
+      
       truncate(str, length) {
         return str.length > length ? str.substring(0, length) + '...' : str
       }

data/lib/query_console/configuration.rb

@@ -3,6 +3,7 @@ module QueryConsole
     attr_accessor :enabled_environments,
                   :max_rows,
                   :timeout_ms,
+                  :timeout_strategy,
                   :authorize,
                   :current_actor,
                   :forbidden_keywords,
@@ -21,6 +22,7 @@ module QueryConsole
       @enabled_environments = ["development"]
       @max_rows = 500
       @timeout_ms = 3000
+      @timeout_strategy = :database # :database (safer, PostgreSQL only) or :ruby (fallback, but can leave orphan queries)
       @authorize = nil # nil means deny by default
       @current_actor = -> (_controller) { "unknown" }
       @forbidden_keywords = %w[

data/lib/query_console/engine.rb

@@ -11,7 +11,7 @@ module QueryConsole
     
     # Load Hotwire (Turbo & Stimulus)
     initializer "query_console.importmap", before: "importmap" do |app|
-      if app.config.respond_to?(:importmap)
+      if defined?(Importmap) && app.config.respond_to?(:importmap)
         app.config.importmap.paths << root.join("config/importmap.rb")
       end
     end

data/lib/query_console/version.rb

@@ -1,3 +1,3 @@
 module QueryConsole
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: query_console
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Johnson Gnanasekar
@@ -16,6 +16,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 7.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -23,6 +26,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 7.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
 - !ruby/object:Gem::Dependency
   name: turbo-rails
   requirement: !ruby/object:Gem::Requirement
@@ -51,20 +57,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
-- !ruby/object:Gem::Dependency
-  name: importmap-rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement