woods 1.6.2 → 1.6.4

data/lib/woods/console/safe_context.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'adapter_family'
+
 # Stub for environments that don't load ActiveRecord
 unless defined?(ActiveRecord::Rollback)
   module ActiveRecord
@@ -86,7 +88,7 @@ module Woods
     #     ]
     #   )
     #
-    class SafeContext
+    class SafeContext # rubocop:disable Metrics/ClassLength
       # Thread-local key that exposes the connection currently leased for
       # the in-flight #execute block. Handlers should prefer this over
       # acquiring their own connection so every request stays on a single
@@ -183,6 +185,36 @@ module Woods
         apply_key_value_redaction(redacted)
       end
 
+      # Add runtime key types to a request-local redaction view. The original
+      # context and its execution policy are unchanged.
+      # @param types [Hash<String, Array<Object>>] Active Record attribute types
+      # @param raw [Boolean] whether keys are raw database cells
+      # @return [SafeContext]
+      def with_key_value_types(types, raw: false)
+        dup.tap do |context|
+          context.instance_variable_set(:@key_value_types, types)
+          context.instance_variable_set(:@raw_key_values, raw)
+        end
+      end
+
+      # Match the database spelling and its application representation. If a
+      # type cannot safely transform a key, protect the value rather than
+      # returning a value whose sensitivity could not be established.
+      # @param value [Object] raw or cast EAV key
+      # @param pattern [Hash] normalized EAV policy
+      # @return [Boolean]
+      def sensitive_key?(value, pattern)
+        sensitive = pattern['sensitive_keys']
+        return true if sensitive.include?(value.to_s)
+
+        Array(@key_value_types&.fetch(pattern['key_column'], nil)).any? do |type|
+          alternate = @raw_key_values ? type.deserialize(value) : type.serialize(value)
+          sensitive.include?(alternate.to_s)
+        rescue StandardError
+          true
+        end
+      end
+
       private
 
       # Wrap one connection in a rolled-back transaction with timeout, and
@@ -194,8 +226,12 @@ module Woods
         Thread.current[LEASED_CONNECTION_KEY] = connection
         result = nil
         connection.transaction do
-          set_timeout(connection)
-          result = yield(connection)
+          restore_timeout = set_timeout(connection)
+          begin
+            result = yield(connection)
+          ensure
+            restore_timeout&.call
+          end
           raise ActiveRecord::Rollback
         end
         result
@@ -225,7 +261,7 @@ module Woods
           key_col = pattern['key_column']
           val_col = pattern['value_column']
           next unless hash.key?(key_col) && hash.key?(val_col)
-          next unless pattern['sensitive_keys'].include?(hash[key_col].to_s)
+          next unless sensitive_key?(hash[key_col], pattern)
 
           hash[val_col] = '[REDACTED]'
         end
@@ -241,14 +277,16 @@ module Woods
       # request, background job, etc.). Safe here because every #execute
       # is wrapped in a transaction.
       #
-      # MySQL uses `SET max_execution_time` (applies to SELECT only — DDL
-      # and DML statements cannot be time-limited via this variable).
+      # MySQL uses session-scoped `SET max_execution_time` for SELECTs.
+      # Return a callback that restores the previous value before releasing
+      # the pooled connection; rollback alone does not reset this setting.
       def set_timeout(connection, timeout_ms = @timeout_ms)
         adapter = connection.adapter_name.downcase
-        if adapter.include?('mysql')
-          connection.execute("SET max_execution_time = #{timeout_ms.to_i}")
+        if AdapterFamily.for(connection) == :mysql
+          set_mysql_timeout(connection, timeout_ms)
         else
           connection.execute("SET LOCAL statement_timeout = '#{timeout_ms.to_i}ms'")
+          nil
         end
       rescue StandardError => e
         # Unsupported adapter (SQLite, Trilogy on unsupported version, Oracle) —
@@ -259,6 +297,16 @@ module Woods
         nil
       end
 
+      def set_mysql_timeout(connection, timeout_ms)
+        maria = connection.respond_to?(:mariadb?) && connection.mariadb?
+        variable = maria ? 'max_statement_time' : 'max_execution_time'
+        timeout = maria ? timeout_ms.to_i / 1000.0 : timeout_ms.to_i
+        previous_value = Float(connection.select_value("SELECT @@SESSION.#{variable}"))
+        connection.execute("SET #{variable} = #{timeout}")
+        previous_value = previous_value.to_i unless maria
+        -> { connection.execute("SET #{variable} = #{previous_value}") }
+      end
+
       def warn_timeout_unsupported(adapter, error)
         return unless defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
 

data/lib/woods/console/server.rb

@@ -176,7 +176,7 @@ module Woods
         # @param unsafe_eval_audit_log_path [String, Pathname, nil] JSONL audit log
         #   path for `console_eval`. Required when the opt-in is on.
         # @return [MCP::Server] Configured server ready for transport
-        def build_embedded(model_validator:, safe_context:, redacted_columns: [], # rubocop:disable Metrics/ParameterLists
+        def build_embedded(model_validator:, safe_context:, redacted_columns: [], # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
                            redacted_key_values: [], connection: nil,
                            read_tools_enabled: false, model_tables: {},
                            model_reflections: {},
@@ -201,6 +201,7 @@ module Woods
           table_gate = ctx&.table_gate
           executor = EmbeddedExecutor.new(
             model_validator: model_validator, safe_context: safe_context,
+            redaction_context: safe_ctx,
             connection: connection, read_tools_enabled: read_tools_enabled,
             table_gate: table_gate,
             eval_guard: eval_wiring[:eval_guard],

data/lib/woods/console/sql_noise_stripper.rb

@@ -24,14 +24,14 @@ module Woods
     #   SqlNoiseStripper.strip_literals("SELECT 'it\\'s ok' FROM t", dialect: :mysql)
     #   # => "SELECT '' FROM t"
     #
-    module SqlNoiseStripper
+    module SqlNoiseStripper # rubocop:disable Metrics/ModuleLength
       # Strips SQL line comments (`-- ...`) and block comments (`/* ... */`).
       # Line comments are stripped to (but not including) the newline so that
       # newline-separated statement structure is preserved for callers that
       # check for multiple statements.
       #
-      # Block comments are non-nested — real SQL engines do not support nested
-      # block comments, and neither does this stripper.
+      # This legacy helper is not a security scanner. Use strip_noise for
+      # quote-aware and PostgreSQL nested-comment handling.
       #
       # @param sql [String] the SQL string to process
       # @return [String] a new string with all SQL comments removed
@@ -40,7 +40,7 @@ module Woods
 
       def self.strip_comments(sql)
         out = sql.gsub(LINE_COMMENT, '')
-        out.gsub(BLOCK_COMMENT, '')
+        out.gsub(BLOCK_COMMENT, ' ')
       end
 
       # Strips single-quoted string literals and (for the `:postgres` dialect)
@@ -53,21 +53,21 @@ module Woods
       # single-quote scanner.
       #
       # @param sql [String] the SQL string to process
-      # @param dialect [Symbol] `:postgres` (default) or `:mysql`.
+      # @param dialect [Symbol] `:postgres` (default), `:mysql`, or `:sqlite`.
       #   - `:postgres` — single-quoted strings support `''` as an apostrophe
       #     escape. Backslash is treated literally and does not escape quotes.
       #     Dollar-quoted strings (`$$...$$`, `$tag$...$tag$`) are also stripped.
       #   - `:mysql` — single-quoted strings support both `\'` (backslash-escape)
       #     and `''` (doubled-quote) as apostrophe escapes. Dollar-quoted strings
-      #     are also stripped (MySQL does not use them, but stripping them is
-      #     harmless and keeps the two dialects consistent).
+      #     are not recognized by the combined MySQL security scanner.
+      #   - `:sqlite` — doubled apostrophes escape strings; backslashes and dollar signs are literal.
       # @return [String] a new string with all string literals replaced by `''`
       # @raise [ArgumentError] if an unsupported dialect is provided
       DOLLAR_QUOTED = /\$(\w*)\$.*?\$\1\$/m
       SINGLE_QUOTED_POSTGRES = /'(?:''|[^'])*'/m
       SINGLE_QUOTED_MYSQL    = /'(?:\\.|''|[^'])*'/m
 
-      SUPPORTED_DIALECTS = %i[postgres mysql].freeze
+      SUPPORTED_DIALECTS = %i[postgres mysql sqlite].freeze
       private_constant :SUPPORTED_DIALECTS
 
       def self.strip_literals(sql, dialect: :postgres)
@@ -77,7 +77,7 @@ module Woods
 
         # Strip dollar-quoted strings first so stray apostrophes inside them
         # do not interfere with the single-quote scanner.
-        out = sql.gsub(DOLLAR_QUOTED, "''")
+        out = dialect == :sqlite ? sql : sql.gsub(DOLLAR_QUOTED, "''")
 
         pattern = dialect == :mysql ? SINGLE_QUOTED_MYSQL : SINGLE_QUOTED_POSTGRES
         out.gsub(pattern, "''")
@@ -97,13 +97,30 @@ module Woods
       # never under-detect: an unterminated literal is treated as an ordinary
       # character rather than swallowing the rest of the statement.
       #
+      # `#` opens a MySQL line comment, mirroring `--`, but only under the
+      # `:mysql` dialect — PostgreSQL does not treat `#` as a comment, and
+      # collapsing it there would hide SQL that a real PostgreSQL server
+      # still executes. A MySQL `/*! ... */` executable comment is left
+      # visible as one span, including MariaDB's `/*M! ... */` spelling:
+      # its body can execute, so it must stay visible to every downstream
+      # scan without changing literal state outside the span. Leaving it
+      # visible under `:postgres` too is over-detection at
+      # worst, never under-detection, on a server where it really is inert.
+      # An ordinary `/* ... */` block comment is replaced by a single
+      # newline rather than vanishing outright, mirroring how a `--`/`#`
+      # line comment's own trailing newline survives: SqlValidator's
+      # statement-leader scan needs a durable marker showing a comment sat
+      # here so a comment-hidden statement (`SELECT 1 /*;*/ DELETE ...`)
+      # still reads as following a boundary once comments are gone.
+      #
       # @param sql [String] the SQL string to process
-      # @param dialect [Symbol] `:postgres` (default) or `:mysql` — controls
-      #   single-quote escape rules (see {.strip_literals}).
+      # @param dialect [Symbol] `:postgres` (default), `:mysql`, or `:sqlite` — controls
+      #   single-quote escape rules (see {.strip_literals}) and whether `#`
+      #   opens a line comment. MySQL quote flags reflect session sql_mode.
       # @return [String] a new string with comments removed and every string
       #   literal replaced by `''`
       # @raise [ArgumentError] if an unsupported dialect is provided
-      def self.strip_noise(sql, dialect: :postgres) # rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity,Metrics/AbcSize
+      def self.strip_noise(sql, dialect: :postgres, ansi_quotes: false, no_backslash_escapes: false) # rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity,Metrics/AbcSize
         unless SUPPORTED_DIALECTS.include?(dialect)
           raise ArgumentError, "Unknown dialect #{dialect.inspect}. Supported: #{SUPPORTED_DIALECTS.inspect}"
         end
@@ -117,7 +134,11 @@ module Woods
           ch = sql[i]
 
           if ch == "'"
-            close = single_quote_end(sql, i, mysql: mysql)
+            close = single_quote_end(
+              sql, i,
+              backslash_escapes: (mysql && !no_backslash_escapes) ||
+                (dialect == :postgres && postgres_escape_string?(sql, i))
+            )
             if close
               out << "''"
               i = close
@@ -126,7 +147,33 @@ module Woods
               out << ch
               i += 1
             end
-          elsif ch == '$' && (tag = dollar_tag_at(sql, i))
+          elsif ch == '"'
+            close = quoted_span_end(sql, i, quote: '"',
+                                            backslash_escapes: mysql && !ansi_quotes && !no_backslash_escapes)
+            if close
+              # MySQL parses double quotes as strings unless ANSI_QUOTES is
+              # enabled. Treating them as literals prevents a `#` inside the
+              # value from hiding live SQL. PostgreSQL uses them for
+              # identifiers, which must remain visible to table/column scans.
+              out << double_quote_replacement(sql, i, close, mysql: mysql && !ansi_quotes)
+              i = close
+            else
+              out << ch
+              i += 1
+            end
+          elsif (mysql || dialect == :sqlite) && ch == '`'
+            close = quoted_span_end(sql, i, quote: '`', backslash_escapes: false)
+            if close
+              # Backticks delimit identifiers. Preserve the token for table
+              # and protected-column scans while shielding comment markers
+              # inside it from the noise scanner.
+              out << sql[i...close]
+              i = close
+            else
+              out << ch
+              i += 1
+            end
+          elsif dialect == :postgres && ch == '$' && !preceded_by_word_char?(sql, i) && (tag = dollar_tag_at(sql, i))
             close = sql.index(tag, i + tag.length)
             if close
               out << "''"
@@ -135,13 +182,33 @@ module Woods
               out << ch
               i += 1
             end
-          elsif ch == '-' && sql[i + 1] == '-'
+          elsif dash_comment?(sql, i, mysql: mysql) || (mysql && ch == '#')
             nl = sql.index("\n", i)
             i = nl || len
+          elsif sql[i, 3] == '/*!' || sql[i, 4] == '/*M!'
+            close = block_comment_end(sql, i, nested: dialect == :postgres)
+            if close
+              comment = sql[i...close]
+              yield comment if block_given?
+              # An executable comment is a lexical boundary even when its
+              # version guard makes its body inert. A quote in that body must
+              # never change the scanner's state outside the comment.
+              out << comment
+              i = close
+            else
+              out << ch
+              i += 1
+            end
           elsif ch == '/' && sql[i + 1] == '*'
-            close = sql.index('*/', i + 2)
+            close = block_comment_end(sql, i, nested: dialect == :postgres)
             if close
-              i = close + 2
+              # Preserve a newline in place of the removed comment, mirroring
+              # line comments (see class docs): callers that check for
+              # statement structure (SqlValidator's statement-leader scan)
+              # need a survivable marker showing a comment sat here, the
+              # same way a `--`/`#` comment's own trailing newline does.
+              out << "\n"
+              i = close
             else
               # Unterminated block comment: never under-detect. Leave it in
               # place (over-detection is safe; the old regex also required a
@@ -158,9 +225,42 @@ module Woods
         out
       end
 
+      def self.block_comment_end(sql, start, nested:)
+        depth = 1
+        position = start + 2
+        while (match = %r{/\*|\*/}.match(sql, position))
+          depth += 1 if nested && match[0] == '/*'
+          depth -= 1 if match[0] == '*/'
+          return match.end(0) if depth.zero?
+
+          position = match.end(0)
+        end
+        nil
+      end
+      private_class_method :block_comment_end
+
+      # Session modes change MySQL quoting without changing the adapter name.
+      # Security consumers must reject SQL unsafe under any supported combination.
+      MYSQL_QUOTE_MODES = [false, true].product([false, true]).map do |ansi, no_backslash|
+        { ansi_quotes: ansi, no_backslash_escapes: no_backslash }.freeze
+      end.freeze
+
+      def self.security_views(sql, dialect:, mysql_modes: nil)
+        modes = dialect == :mysql && mysql_modes.nil? ? MYSQL_QUOTE_MODES : [mysql_modes || {}]
+        modes.map { |mode| strip_noise(sql, dialect: dialect, **mode) }.uniq
+      end
+
+      # MySQL requires whitespace/control after --; otherwise it is subtraction.
+      def self.dash_comment?(sql, index, mysql:)
+        return false unless sql[index, 2] == '--'
+
+        !mysql || sql[index + 2].nil? || sql[index + 2].match?(/[[:space:][:cntrl:]]/)
+      end
+      private_class_method :dash_comment?
+
       # Regexp matching a PostgreSQL dollar-quote opening tag (`$$` or
       # `$tag$`) at the start of the given slice.
-      DOLLAR_TAG = /\A\$\w*\$/
+      DOLLAR_TAG = /\A\$(?:[A-Za-z_\u0080-\u{10ffff}][A-Za-z0-9_\u0080-\u{10ffff}]*)?\$/u
       private_constant :DOLLAR_TAG
 
       # Return the dollar-quote tag opening at +index+, or nil.
@@ -172,29 +272,69 @@ module Woods
       end
       private_class_method :dollar_tag_at
 
+      # Whether the character immediately before +index+ is a word character
+      # (including high-bit characters). PostgreSQL allows `$` inside identifiers (`x$a$`), so a `$`
+      # is only a candidate dollar-quote opener when it does NOT follow an
+      # identifier character — otherwise `x$a$ FROM blocked, (SELECT 1 AS
+      # z$a$)` gets misread as one dollar-quoted literal spanning the real
+      # FROM clause.
+      #
+      # @api private
+      def self.preceded_by_word_char?(sql, index)
+        index.positive? && sql[index - 1].match?(/[A-Za-z0-9_$\u0080-\u{10ffff}]/u)
+      end
+      private_class_method :preceded_by_word_char?
+
       # Return the index just past the closing quote of the single-quoted
       # literal that opens at +start+, honoring `''` (both dialects) and `\'`
       # (MySQL only) escapes. Returns nil when the literal is unterminated.
       #
       # @api private
-      def self.single_quote_end(sql, start, mysql:)
+      def self.single_quote_end(sql, start, backslash_escapes:)
+        quoted_span_end(sql, start, quote: "'", backslash_escapes: backslash_escapes)
+      end
+      private_class_method :single_quote_end
+
+      def self.double_quote_replacement(sql, start, close, mysql:)
+        mysql ? "''" : sql[start...close]
+      end
+      private_class_method :double_quote_replacement
+
+      # Return the index just past a quoted span. Doubled delimiters escape
+      # themselves in every supported dialect; MySQL strings/identifiers and
+      # PostgreSQL E-strings additionally honor backslash escapes.
+      #
+      # @api private
+      def self.quoted_span_end(sql, start, quote:, backslash_escapes:)
         i = start + 1
         len = sql.length
         while i < len
           c = sql[i]
-          if mysql && c == '\\'
+          if backslash_escapes && c == '\\'
             i += 2
-          elsif c == "'"
-            return i + 1 unless sql[i + 1] == "'" # closing quote
+          elsif c == quote
+            return i + 1 unless sql[i + 1] == quote # closing delimiter
 
-            i += 2 # doubled-quote escape — literal continues
+            i += 2 # doubled-delimiter escape — span continues
           else
             i += 1
           end
         end
         nil
       end
-      private_class_method :single_quote_end
-    end
+      private_class_method :quoted_span_end
+
+      # PostgreSQL E'...' strings opt into C-style backslash escapes. The E
+      # must begin a token; an identifier ending in e immediately before a
+      # quote is not an escape-string prefix.
+      #
+      # @api private
+      def self.postgres_escape_string?(sql, quote_index)
+        return false unless quote_index.positive? && sql[quote_index - 1].match?(/[eE]/)
+
+        quote_index < 2 || !sql[quote_index - 2].match?(/[A-Za-z0-9_$\u0080-\u{10ffff}]/u)
+      end
+      private_class_method :postgres_escape_string?
+    end # rubocop:enable Metrics/ModuleLength
   end
 end