execsql2 2.17.2__py3-none-any.whl → 2.18.0__py3-none-any.whl

execsql/utils/fileio.py

@@ -84,6 +84,102 @@ def check_dir(filename: str) -> None:
                 raise ErrInfo(type="error", other_msg=f"The directory for file '{filename}' does not exist.")
 
 
+def check_zip_decompression_ratio(
+    path: str | os.PathLike[str],
+    *,
+    max_uncompressed_mb: int = 500,
+    max_ratio: int = 100,
+) -> None:
+    """Reject a zip-based workbook that looks like a decompression bomb.
+
+    OOXML (``.xlsx``) is a zip archive. A maliciously crafted file
+    can name a 1 GB uncompressed member that compresses to a few KB,
+    so blindly handing the path to ``openpyxl.load_workbook`` lets
+    the parser allocate proportional memory. This wrapper inspects
+    the zip directory entries before any parsing happens and raises
+    :class:`ErrInfo` when either bound is exceeded:
+
+    * ``max_uncompressed_mb`` — sum of all members' uncompressed
+      sizes (default 500 MB).
+    * ``max_ratio`` — per-member uncompressed:compressed ratio
+      (default 100:1; legitimate XML-heavy XLSX rarely exceeds 30:1).
+
+    No-op when *path* is not a zipfile (e.g. legacy ``.xls`` OLE-CDF).
+    """
+    import zipfile
+
+    try:
+        with zipfile.ZipFile(path) as zf:
+            total_uncompressed = 0
+            for info in zf.infolist():
+                total_uncompressed += info.file_size
+                if info.compress_size > 0:
+                    ratio = info.file_size / info.compress_size
+                    if ratio > max_ratio:
+                        raise ErrInfo(
+                            type="error",
+                            other_msg=(
+                                f"Refusing to open '{path}': member '{info.filename}' has "
+                                f"compression ratio {ratio:.1f}:1 (limit {max_ratio}:1) - "
+                                "possible zip-bomb."
+                            ),
+                        )
+            limit_bytes = max_uncompressed_mb * 1024 * 1024
+            if total_uncompressed > limit_bytes:
+                raise ErrInfo(
+                    type="error",
+                    other_msg=(
+                        f"Refusing to open '{path}': total uncompressed size "
+                        f"{total_uncompressed / 1024 / 1024:.0f} MB exceeds limit "
+                        f"{max_uncompressed_mb} MB - possible zip-bomb."
+                    ),
+                )
+    except zipfile.BadZipFile:
+        # Not a zip file (legacy .xls is OLE-CDF, not zip). Nothing to check.
+        pass
+
+
+def safe_output_path(user_path: str, root: str | os.PathLike[str] | None) -> str:
+    """Resolve *user_path* and verify it lives under *root*.
+
+    If *root* is ``None`` or empty, returns *user_path* unchanged — the
+    caller has opted out of containment (current default behavior, no
+    regression for users who don't set the corresponding config key).
+
+    If *root* is set, *user_path* is joined to *root* (when relative) or
+    interpreted directly (when absolute), then ``.resolve()``'d and
+    verified to be at or below the resolved root. Absolute paths,
+    Windows drive letters, and UNC paths that don't fall under *root*
+    raise :class:`ErrInfo` rather than silently bypassing the
+    boundary.
+
+    Returns the resolved path as a string. Raises :class:`ErrInfo`
+    when *user_path* escapes *root*.
+    """
+    if not root:
+        return user_path
+    root_path = Path(root).expanduser().resolve()
+    candidate = Path(user_path).expanduser()
+    # Reject UNC paths (//server/share or \\server\share) when a root
+    # is set — these always escape a local root.
+    if user_path.startswith(("//", r"\\")):
+        raise ErrInfo(
+            type="error",
+            other_msg=f"Path '{user_path}' is outside the allowed root '{root_path}'.",
+        )
+    if not candidate.is_absolute():
+        candidate = root_path / candidate
+    resolved = candidate.resolve()
+    try:
+        resolved.relative_to(root_path)
+    except ValueError:
+        raise ErrInfo(
+            type="error",
+            other_msg=f"Path '{user_path}' resolves to '{resolved}', which is outside the allowed root '{root_path}'.",
+        ) from None
+    return str(resolved)
+
+
 class FileWriter(multiprocessing.Process):
     # An object of this class is intended to be used as a subprocess.
     # All files that are to be written to are kept open until explicitly closed or the object is destroyed.
@@ -449,6 +545,22 @@ class EncodedFile:
     def close(self) -> None:
         if self.fo is not None:
             self.fo.close()
+            self.fo = None
+
+    # B11/F049: context-manager protocol so callers can use ``with
+    # EncodedFile(...) as fh:`` and have the file closed automatically.
+    # The previous code required every site to remember an explicit
+    # close in a try/finally, which several call paths didn't do.
+    def __enter__(self) -> io.TextIOWrapper:
+        # Default to read mode when used directly as a context manager.
+        # Callers that need a different mode should call ``open(mode)``
+        # before entering the ``with`` block.
+        if self.fo is None:
+            self.open("r")
+        return self.fo
+
+    def __exit__(self, exc_type, exc_val, exc_tb) -> None:
+        self.close()
 
 
 class Logger:
@@ -499,6 +611,14 @@ class Logger:
             errmsg = f"Can't open log file {self.log_file_name}"
             e = ErrInfo("exception", exception_msg=exception_desc(), other_msg=errmsg)
             exit_now(1, e, errmsg)
+        # B12/F017: tighten log file mode to 0o600 on POSIX. The log
+        # captures substituted SQL, -a values, env vars, and DSN URLs;
+        # the default umask (typically 022) leaves it world-readable.
+        if os.name == "posix":
+            try:
+                os.chmod(self.log_file_name, 0o600)
+            except Exception:
+                pass  # Best-effort hardening; don't break logging if chmod fails.
         if not f_exists:
             self.writelog(
                 "# Execsql log.\n# The first value on each line is the record type.\n"

execsql/utils/gui.py

@@ -248,11 +248,21 @@ def enable_gui() -> None:
 
     framework = _state.conf.gui_framework if _state.conf else "tkinter"
 
+    # --- Headless POSIX guard ----------------------------------------------
+    # B20/F041: on POSIX without DISPLAY or WAYLAND_DISPLAY, Tkinter's
+    # ``tk.Tk()`` constructor raises a cryptic _tkinter.TclError. Skip
+    # straight to a non-GUI backend on headless systems so the fallback
+    # path is taken cleanly rather than after a confusing TclError that
+    # the broad ``except Exception`` would swallow.
+    import os as _os
+
+    headless_posix = _os.name == "posix" and not _os.environ.get("DISPLAY") and not _os.environ.get("WAYLAND_DISPLAY")
+
     # --- Tkinter sync path --------------------------------------------------
     # Tkinter must run on the main thread (required on macOS).  Use a sync
     # queue that dispatches dialogs directly in the calling thread instead of
     # routing through a background manager thread.
-    if framework == "tkinter":
+    if framework == "tkinter" and not headless_posix:
         try:
             from execsql.gui.desktop import TkinterBackend, _TkinterSyncQueue
 

{execsql2-2.17.2.data → execsql2-2.18.0.data}/data/execsql2_extras/md_compare.sql

@@ -114,7 +114,7 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
+	k.table_name = !'!#table!'!
 	and tc.constraint_schema = '!!$db_name!!'
 order by k.ordinal_position
 ;
@@ -137,8 +137,8 @@ from information_schema.columns as s
 	inner join information_schema.columns as b on s.column_name=b.column_name
 	left join cmp_primary_key_columns as pk on pk.column_name = s.column_name
 where
-	s.table_name = '!!#stage_pfx!!!!#table!!'
-	and b.table_name = '!!#table!!'
+	s.table_name = concat(!'!#stage_pfx!'!, !'!#table!'!)
+	and b.table_name = !'!#table!'!
 	and pk.column_name is null
 	!!~col_sel!!
 order by s.ordinal_position;
@@ -251,7 +251,7 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
+	k.table_name = !'!#table!'!
 	and tc.constraint_schema = '!!$db_name!!'
 order by k.ordinal_position
 ;
@@ -274,8 +274,8 @@ from information_schema.columns as s
 	inner join information_schema.columns as b on s.column_name=b.column_name
 	left join cmp_primary_key_columns as pk on pk.column_name = s.column_name
 where
-	s.table_name = '!!#stage_pfx!!!!#table!!'
-	and b.table_name = '!!#table!!'
+	s.table_name = concat(!'!#stage_pfx!'!, !'!#table!'!)
+	and b.table_name = !'!#table!'!
 	and pk.column_name is null
 	!!~col_sel!!
 order by s.ordinal_position;
@@ -391,7 +391,7 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
+	k.table_name = !'!#table!'!
 	and tc.constraint_schema = '!!$db_name!!'
 order by k.ordinal_position
 ;
@@ -415,8 +415,8 @@ from information_schema.columns as s
 	inner join information_schema.columns as b on s.column_name=b.column_name
 	left join cmp_primary_key_columns as pk on pk.column_name = s.column_name
 where
-	s.table_name = '!!#stage_pfx!!!!#table!!'
-	and b.table_name = '!!#table!!'
+	s.table_name = concat(!'!#stage_pfx!'!, !'!#table!'!)
+	and b.table_name = !'!#table!'!
 	and pk.column_name is null
 	!!~col_sel!!
 order by s.ordinal_position;
@@ -542,7 +542,7 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
+	k.table_name = !'!#table!'!
 	and tc.constraint_schema = '!!$db_name!!'
 order by k.ordinal_position
 ;
@@ -565,8 +565,8 @@ from information_schema.columns as s
 	inner join information_schema.columns as b on s.column_name=b.column_name
 	left join cmp_primary_key_columns as pk on pk.column_name = s.column_name
 where
-	s.table_name = '!!#stage_pfx!!!!#table!!'
-	and b.table_name = '!!#table!!'
+	s.table_name = concat(!'!#stage_pfx!'!, !'!#table!'!)
+	and b.table_name = !'!#table!'!
 	and pk.column_name is null
 	!!~col_sel!!
 order by s.ordinal_position;

{execsql2-2.17.2.data → execsql2-2.18.0.data}/data/execsql2_extras/md_glossary.sql

@@ -146,7 +146,7 @@ with recursive itemtable as (
 		select
 			trim(substring_index(data, ',', 1)) as column_name,
 			right(data, length(data) - locate(',', data, 1)) as data
-		from (select '!!#column_list!!' as data) as input
+		from (select !'!#column_list!'! as data) as input
 		union
 		select
 			trim(substring_index(data, ',', 1)) as column_name,
@@ -254,7 +254,7 @@ select !!gls_collist!! from gls_newglossary;
 	select
 		inp.item, inp.definition, inp.url
 	from
-		(select '!!#item!!'::text as item, '!!#definition!!'::text as definition, '!!#def_url!!'::text as url) as inp
+		(select !'!#item!'!::text as item, !'!#definition!'!::text as definition, !'!#def_url!'!::text as url) as inp
 		left join gls_glossary as g on g.!!gls_name!! = inp.item
 	where
 		g.!!gls_name!! is null;
@@ -264,8 +264,8 @@ select !!gls_collist!! from gls_newglossary;
 		inp.item, inp.definition
 	from
 		(select
-			cast('!!#item!!' as varchar(255)) as item,
-			cast('!!#definition!!' as varchar(255)) as definition
+			cast(!'!#item!'! as varchar(255)) as item,
+			cast(!'!#definition!'! as varchar(255)) as definition
 		) as inp
 		left join gls_glossary as g on g.!!gls_name!! = inp.item
 	where
@@ -307,7 +307,7 @@ select
 from
 	information_schema.columns
 where
-	table_name = '!!#table!!'
+	table_name = !'!#table!'!
 	;
 -- !x! subdata ~collist gls_collist
 

{execsql2-2.17.2.data → execsql2-2.18.0.data}/data/execsql2_extras/md_upsert.sql

@@ -182,12 +182,12 @@ from
 	(
 	select
 		'base' as schema_type,
-		'!!#table!!' as table_name
+		!'!#table!'! as table_name
 	union
 	select
 
 		'staging' as schema_type,
-		'!!#stage_pfx!!!!#table!!' as table_name
+		concat(!'!#stage_pfx!'!, !'!#table!'!) as table_name
 	) as tt
 	left join information_schema.tables as iss on tt.table_name=iss.table_name
 where
@@ -276,7 +276,7 @@ where
 update ups_validate_control as vc, information_schema.tables as st
 set vc.staging_exists = True
 where
-	st.table_name= concat('!!#stage_pfx!!', vc.table_name)
+	st.table_name= concat(!'!#stage_pfx!'!, vc.table_name)
 	and st.table_type='BASE TABLE'
 	and st.table_schema = '!!$DB_NAME!!'
 ;
@@ -293,7 +293,7 @@ from
 		from ups_validate_control
 		where not base_exists
 		union
-		select concat('!!#stage_pfx!!', table_name) as schema_table
+		select concat(!'!#stage_pfx!'!, table_name) as schema_table
 		from ups_validate_control
 		where not staging_exists
 		) as it
@@ -427,7 +427,7 @@ with recursive itemtable as (
 		select
 			trim(substring_index(data, ',', 1)) as table_name,
 			right(data, length(data) - locate(',', data, 1)) as data
-		from (select '!!#table_list!!' as data) as input
+		from (select !'!#table_list!'! as data) as input
 		union
 		select
 			trim(substring_index(data, ',', 1)) as table_name,
@@ -624,7 +624,7 @@ from
 	information_schema.columns
 where
 	table_schema = '!!$DB_NAME!!'
-	and table_name = '!!#table!!'
+	and table_name = !'!#table!'!
 	and is_nullable = 'NO'
 	and column_default is null
 	!!~omitnull!!
@@ -783,7 +783,7 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
+	k.table_name = !'!#table!'!
 	and tc.constraint_schema = '!!$db_name!!'
 order by k.ordinal_position
 ;
@@ -998,7 +998,7 @@ from
 	ups_foreign_key_columns
 where
 	table_schema = '!!$DB_NAME!!'
-	and table_name = '!!#table!!';
+	and table_name = !'!#table!'!;
 
 -- Create a table of all unique constraint names for
 -- this table, with an integer column to be populated with the
@@ -1257,7 +1257,7 @@ create table ups_cols
 select column_name
 from information_schema.columns
 where
-	table_name = '!!#stage_pfx!!!!#table!!'
+	table_name = concat(!'!#stage_pfx!'!, !'!#table!'!)
 	and table_schema = '!!$DB_NAME!!'
 	!!~col_excl!!
 order by ordinal_position;
@@ -1280,7 +1280,7 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
+	k.table_name = !'!#table!'!
 	and k.table_schema = '!!$DB_NAME!!'
 order by k.ordinal_position;
 
@@ -2103,7 +2103,7 @@ inner join information_schema.key_column_usage as k
 	and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
+	k.table_name = !'!#table!'!
 	and k.table_schema = '!!$DB_NAME!!'
 ;
 
@@ -2335,7 +2335,7 @@ where
 			from information_schema.columns
 			where
 				table_schema = '!!$DB_NAME!!'
-				and table_name = '!!#stage_pfx!!!!#table!!'
+				and table_name = concat(!'!#stage_pfx!'!, !'!#table!'!)
 			) as stag on  pk.newpk_col=stag.column_name
 	where
 		stag.column_name is null
@@ -2731,7 +2731,7 @@ where
             		and cu_uq.table_name = tc_uq.table_name
 					and cu_uq.ordinal_position = cu.ordinal_position
 			where
-				rc.table_name = '!!#table!!'
+				rc.table_name = !'!#table!'!
 				;
 
 			-- Narrow the list down to ONLY dependencies that affect PK columns

{execsql2-2.17.2.data → execsql2-2.18.0.data}/data/execsql2_extras/pg_compare.sql

@@ -118,8 +118,8 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
-	and k.table_schema = '!!#base_schema!!'
+	k.table_name = !'!#table!'!
+	and k.table_schema = !'!#base_schema!'!
 order by k.ordinal_position
 ;
 
@@ -141,10 +141,10 @@ from information_schema.columns as s
 	inner join information_schema.columns as b on s.column_name=b.column_name
 	left join cmp_primary_key_columns as pk on pk.column_name = s.column_name
 where
-	s.table_schema = '!!#staging!!'
-	and s.table_name = '!!#table!!'
-	and b.table_schema = '!!#base_schema!!'
-	and b.table_name = '!!#table!!'
+	s.table_schema = !'!#staging!'!
+	and s.table_name = !'!#table!'!
+	and b.table_schema = !'!#base_schema!'!
+	and b.table_name = !'!#table!'!
 	and pk.column_name is null
 	!!~col_sel!!
 order by s.ordinal_position;
@@ -255,8 +255,8 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
-	and k.table_schema = '!!#base_schema!!'
+	k.table_name = !'!#table!'!
+	and k.table_schema = !'!#base_schema!'!
 order by k.ordinal_position
 ;
 
@@ -278,10 +278,10 @@ from information_schema.columns as s
 	inner join information_schema.columns as b on s.column_name=b.column_name
 	left join cmp_primary_key_columns as pk on pk.column_name = s.column_name
 where
-	s.table_schema = '!!#staging!!'
-	and s.table_name = '!!#table!!'
-	and b.table_schema = '!!#base_schema!!'
-	and b.table_name = '!!#table!!'
+	s.table_schema = !'!#staging!'!
+	and s.table_name = !'!#table!'!
+	and b.table_schema = !'!#base_schema!'!
+	and b.table_name = !'!#table!'!
 	and pk.column_name is null
 	!!~col_sel!!
 order by s.ordinal_position;
@@ -393,8 +393,8 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
-	and k.table_schema = '!!#base_schema!!'
+	k.table_name = !'!#table!'!
+	and k.table_schema = !'!#base_schema!'!
 order by k.ordinal_position
 ;
 
@@ -416,10 +416,10 @@ from information_schema.columns as s
 	inner join information_schema.columns as b on s.column_name=b.column_name
 	left join cmp_primary_key_columns as pk on pk.column_name = s.column_name
 where
-	s.table_schema = '!!#staging!!'
-	and s.table_name = '!!#table!!'
-	and b.table_schema = '!!#base_schema!!'
-	and b.table_name = '!!#table!!'
+	s.table_schema = !'!#staging!'!
+	and s.table_name = !'!#table!'!
+	and b.table_schema = !'!#base_schema!'!
+	and b.table_name = !'!#table!'!
 	!!~col_sel!!
 order by s.ordinal_position;
 
@@ -540,8 +540,8 @@ inner join information_schema.key_column_usage as k
     and tc.table_name = k.table_name
 	and tc.constraint_name = k.constraint_name
 where
-	k.table_name = '!!#table!!'
-	and k.table_schema = '!!#base_schema!!'
+	k.table_name = !'!#table!'!
+	and k.table_schema = !'!#base_schema!'!
 order by k.ordinal_position
 ;
 
@@ -563,10 +563,10 @@ from information_schema.columns as s
 	inner join information_schema.columns as b on s.column_name=b.column_name
 	left join cmp_primary_key_columns as pk on pk.column_name = s.column_name
 where
-	s.table_schema = '!!#staging!!'
-	and s.table_name = '!!#table!!'
-	and b.table_schema = '!!#base_schema!!'
-	and b.table_name = '!!#table!!'
+	s.table_schema = !'!#staging!'!
+	and s.table_name = !'!#table!'!
+	and b.table_schema = !'!#base_schema!'!
+	and b.table_name = !'!#table!'!
 	!!~col_sel!!
 order by s.ordinal_position;
 

{execsql2-2.17.2.data → execsql2-2.18.0.data}/data/execsql2_extras/pg_glossary.sql

@@ -134,7 +134,7 @@ from gls_glossary order by !!gls_name!!;
 
 drop table if exists gls_column_list cascade;
 select
-	trim(regexp_split_to_table('!!#column_list!!', E'\\s*,\\s*')) as !!gls_name!!
+	trim(regexp_split_to_table(!'!#column_list!'!, E'\\s*,\\s*')) as !!gls_name!!
 into
 	gls_column_list;
 
@@ -220,7 +220,7 @@ drop table gls_newglossary cascade;
 	select
 		inp.item, inp.definition, inp.url
 	from
-		(select '!!#item!!'::text as item, '!!#definition!!'::text as definition, '!!#def_url!!'::text as url) as inp
+		(select !'!#item!'!::text as item, !'!#definition!'!::text as definition, !'!#def_url!'!::text as url) as inp
 		left join gls_glossary as g on g.!!gls_name!! = inp.item
 	where
 		g.!!gls_name!! is null;
@@ -229,7 +229,7 @@ drop table gls_newglossary cascade;
 	select
 		inp.item, inp.definition
 	from
-		(select '!!#item!!'::text as item, '!!#definition!!'::text as definition) as inp
+		(select !'!#item!'!::text as item, !'!#definition!'!::text as definition) as inp
 		left join gls_glossary as g on g.!!gls_name!! = inp.item
 	where
 		g.!!gls_name!! is null;
@@ -265,7 +265,7 @@ drop table gls_newglossary cascade;
 -- !x! if(is_null("!!#schema!!"))
 	-- !x! sub_empty ~schema_sel
 -- !x! else
-	-- !x! sub ~schema_sel and table_schema = '!!#schema!!'
+	-- !x! sub ~schema_sel and table_schema = !'!#schema!'!
 -- !x! endif
 drop view if exists gls_collist cascade;
 create temporary view gls_collist as
@@ -274,7 +274,7 @@ select
 from
 	information_schema.columns
 where
-	table_name = '!!#table!!'
+	table_name = !'!#table!'!
 	!!~schema_sel!!
 	;
 -- !x! subdata ~collist gls_collist