ghostbase-cli 0.1.2__tar.gz → 0.1.3__tar.gz

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ghostbase-cli
-Version: 0.1.2
+Version: 0.1.3
 Summary: A fast, keyboard-driven terminal database studio for SQLite, PostgreSQL & MySQL
 Author-email: 4yk5 <contact.4yk5@proton.me>
 License-Expression: MIT

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.3}/app.py

@@ -342,7 +342,7 @@ class GhostBaseApp(App):
             yield Label(f"[{self.db.db_type_label()}]", id="db-type-label")
             yield Label(db_label, id="db-name-label")
             yield Label(safe_text, id="safe-badge", classes=safe_class)
-            yield Label("v0.1.2", id="version-label")
+            yield Label("v0.1.3", id="version-label")
 
         with Horizontal(id="main-container"):
             with Vertical(id="sidebar"):
@@ -389,9 +389,13 @@ class GhostBaseApp(App):
     # Lifecycle
 
     async def on_mount(self):
-        # Configure database engine level Read-Only mode if safe_mode is enabled
+        # Configure database engine level Read-Only mode if safe_mode is enabled (fail-closed)
         if self.safe_mode:
-            self.db.set_read_only(True)
+            try:
+                self.db.set_read_only(True)
+            except Exception as e:
+                self.safe_mode = False
+                self.notify(f"Failed to enable Read-Only mode on database: {e}", severity="error")
 
         tables = self.db.get_tables()
         # Only populate demo tables when explicitly requested, in-memory, or default sample.db AND NOT in safe_mode
@@ -810,13 +814,18 @@ class GhostBaseApp(App):
         self.notify("Execution Plan analyzed successfully")
 
     def action_toggle_safe_mode(self):
-        """Toggle Production Safe Mode (Ctrl+S)"""
-        self.safe_mode = not self.safe_mode
+        """Toggle Production Safe Mode (Ctrl+S) - Fail-closed"""
+        new_mode = not self.safe_mode
         self._pending_destructive_query = None
         self._pending_destructive_time = 0.0
 
-        # Enforce/revoke database session level Read-Only
-        self.db.set_read_only(self.safe_mode)
+        # Enforce/revoke database session level Read-Only (Fail-closed)
+        try:
+            self.db.set_read_only(new_mode)
+            self.safe_mode = new_mode
+        except Exception as e:
+            self.notify(f"Cannot enable Safe Mode: {e}", severity="error", timeout=5)
+            return
 
         badge = self.query_one("#safe-badge", Label)
         if self.safe_mode:
@@ -905,7 +914,7 @@ class GhostBaseApp(App):
             else os.getcwd()
         )
         out = os.path.join(db_dir, "ghostbase_export.sql")
-        Exporter.to_sql_inserts(table_name, self.last_columns, self.last_rows, out)
+        Exporter.to_sql_inserts(table_name, self.last_columns, self.last_rows, out, dialect=self.db.db_type)
         self.notify(f"Saved: {out}", timeout=5)
 
     # Status bar

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.3}/db_engine.py

@@ -65,20 +65,24 @@ class DatabaseEngine:
                 "Run:  pip install pymysql"
             )
         parsed = urllib.parse.urlparse(url)
+        # Use SSDictCursor (Server-Side streaming cursor) to protect client memory on massive queries
         self.conn = pymysql.connect(
             host=parsed.hostname or "localhost",
             port=parsed.port or 3306,
             user=parsed.username or "root",
             password=parsed.password or "",
             database=parsed.path.lstrip("/"),
-            cursorclass=pymysql.cursors.DictCursor,
+            cursorclass=pymysql.cursors.SSDictCursor,
             autocommit=True,
         )
 
-    def set_read_only(self, enabled: bool):
-        """Configure database engine session-level Read-Only mode."""
+    def set_read_only(self, enabled: bool) -> bool:
+        """
+        Configure database engine session-level Read-Only mode.
+        Returns True if successful. Raises RuntimeError if enabling fails (fail-closed).
+        """
         if not self.conn:
-            return
+            return False
         try:
             cur = self.conn.cursor()
             if self.db_type == "sqlite":
@@ -90,8 +94,11 @@ class DatabaseEngine:
             elif self.db_type == "mysql":
                 mode = "READ ONLY" if enabled else "READ WRITE"
                 cur.execute(f"SET SESSION TRANSACTION {mode};")
-        except Exception:
-            pass
+            return True
+        except Exception as e:
+            if enabled:
+                raise RuntimeError(f"Database engine failed to activate Read-Only mode: {e}")
+            return False
 
     def quote_table_name(self, table_name: str) -> str:
         """Properly quote table identifier for queries based on database engine."""
@@ -103,6 +110,9 @@ class DatabaseEngine:
                 return f'"{s}"."{t}"'
             return f'"{table_name}"'
         elif self.db_type == "mysql":
+            if "." in table_name:
+                s, t = table_name.split(".", 1)
+                return f"`{s}`.`{t}`"
             return f"`{table_name}`"
         else:  # sqlite
             return f"[{table_name}]"
@@ -347,10 +357,10 @@ class DatabaseEngine:
     def _mask_strings_and_literals(sql: str) -> Tuple[str, List[str]]:
         """
         Extract and mask all string literals and quoted identifiers:
-        - PostgreSQL dollar-quoted strings ($$ ... $$ or $tag$ ... $tag$)
-        - Standard single-quoted strings ('...')
-        - Standard double-quoted strings / identifiers ("...")
-        - MySQL backtick identifiers (`...`)
+        - PostgreSQL dollar-quoted strings with exact tag matching: $tag$ ... $tag$ (using backreference \2)
+        - Standard single-quoted strings: '...' (with '' escaping)
+        - Standard double-quoted strings / identifiers: "..."
+        - MySQL backtick identifiers: `...`
         """
         literals = []
         def _repl(m):
@@ -358,7 +368,13 @@ class DatabaseEngine:
             literals.append(m.group(0))
             return f" ___GB_LIT_{idx}___ "
 
-        pattern = r"(\$(?:[a-zA-Z_]\w*)?\$[\s\S]*?\$(?:[a-zA-Z_]\w*)?\$|'(?:''|[^'])*'|\"(?:\"\"|[^\"])*\"|`(?:``|[^`])*`)"
+        # Matches:
+        # 1. Plain untagged dollar-quotes: $$...$$
+        # 2. Tagged dollar-quotes with strict matching backreference: $tag$...$tag$
+        # 3. Standard single-quoted strings: '...'
+        # 4. Standard double-quoted strings/identifiers: "..."
+        # 5. MySQL backticks: `...`
+        pattern = r"(\$\$[\s\S]*?\$\$|\$([a-zA-Z_]\w*)\$[\s\S]*?\$\2\$|'(?:''|[^'])*'|\"(?:\"\"|[^\"])*\"|`(?:``|[^`])*`)"
         masked = re.sub(pattern, _repl, sql)
         return masked, literals
 
@@ -367,7 +383,7 @@ class DatabaseEngine:
         Check query safety.
         - Strings and dollar-quotes are masked FIRST so inner text ('WHERE ...') does not bypass checks.
         - Comments (-- and /* */) are stripped second.
-        - In Safe Mode: Enforces strict Read-Only operations.
+        - In Safe Mode: Enforces strict Read-Only operations, blocking all DML, DDL, DO blocks, CALL, and SET configuration changes.
         - In Normal Mode: Intercepts unconstrained destructive queries.
         """
         # 1. Mask all string literals and dollar-quoted strings FIRST
@@ -400,10 +416,15 @@ class DatabaseEngine:
                 (r"\bNEXTVAL\s*\(", "NEXTVAL sequence advance"),
                 (r"\bINTO\s+OUTFILE\b", "INTO OUTFILE export"),
                 (r"\bINTO\s+DUMPFILE\b", "INTO DUMPFILE export"),
+                (r"\bSET\b", "SET configuration change"),
+                (r"\bRESET\b", "RESET configuration change"),
+                (r"\bDO\b", "DO procedural block"),
+                (r"\bCALL\b", "CALL stored procedure"),
+                (r"\bMERGE\b", "MERGE statement"),
             ]
             for pattern, desc in write_keywords:
                 if re.search(pattern, q_upper):
-                    return True, f"Safe Mode is active: write operations ({desc}) are strictly blocked"
+                    return True, f"Safe Mode is active: write or state-altering operations ({desc}) are strictly blocked"
 
             if re.search(r"\bPRAGMA\b\s+\w+\s*=", q_upper):
                 return True, "Safe Mode is active: PRAGMA configuration writes are blocked"
@@ -504,16 +525,27 @@ class DatabaseEngine:
 
     def execute_query(self, query: str, max_rows: int = 1000) -> Dict[str, Any]:
         start = time.perf_counter()
+        cur = None
         try:
             # Check if query is DML/DDL write operation (even if it has RETURNING)
             masked, _ = self._mask_strings_and_literals(query)
             clean_q = re.sub(r"/\*[\s\S]*?\*/", " ", masked)
             clean_q = re.sub(r"--[^\r\n]*", " ", clean_q).strip().upper()
             is_write_dml = bool(
-                re.search(r"\b(INSERT\s+INTO|UPDATE\s+|DELETE\s+FROM|DELETE\s+|REPLACE\s+INTO|CREATE\s+|DROP\s+|ALTER\s+|TRUNCATE\s+)\b", clean_q)
+                re.search(r"\b(INSERT\s+INTO|UPDATE\s+|DELETE\s+FROM|DELETE\s+|REPLACE\s+INTO|CREATE\s+|DROP\s+|ALTER\s+|TRUNCATE\s+|DO\s+|CALL\s+|MERGE\s+)\b", clean_q)
             )
 
-            cur = self.conn.cursor()
+            # Use server-side streaming cursor for PostgreSQL read queries to prevent client RAM overflow
+            if self.db_type == "postgresql" and not is_write_dml:
+                stream_name = f"gb_stream_{int(time.perf_counter() * 1000000)}"
+                try:
+                    cur = self.conn.cursor(name=stream_name)
+                    cur.itersize = max_rows + 1
+                except Exception:
+                    cur = self.conn.cursor()
+            else:
+                cur = self.conn.cursor()
+
             cur.execute(query)
             elapsed_ms = (time.perf_counter() - start) * 1000
 
@@ -569,6 +601,12 @@ class DatabaseEngine:
                 "error": str(e),
                 "elapsed_ms": round(elapsed_ms, 2),
             }
+        finally:
+            if cur:
+                try:
+                    cur.close()
+                except Exception:
+                    pass
 
     # --- Helpers ---
 

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.3}/exporter.py

@@ -40,11 +40,14 @@ class Exporter:
         return deduped
 
     @staticmethod
-    def _escape_ident(ident: str) -> str:
+    def _escape_ident(ident: str, dialect: str = "sqlite") -> str:
         s = str(ident).strip()
+        q = "`" if str(dialect).lower() == "mysql" else '"'
+        escaped_q = q * 2
+
         if "." in s:
             parts = s.split(".")
-            return ".".join(f'"{p.replace(chr(34), chr(34)*2)}"' for p in parts)
+            return ".".join(f"{q}{p.replace(q, escaped_q)}{q}" for p in parts)
 
         reserved = {
             "ALL", "ALTER", "AND", "ANY", "AS", "ASC", "BETWEEN", "BY", "CASE",
@@ -59,8 +62,8 @@ class Exporter:
             "USER", "VALUES", "VIEW", "WHEN", "WHERE", "WITH"
         }
         if not s.isidentifier() or s.upper() in reserved:
-            escaped = s.replace('"', '""')
-            return f'"{escaped}"'
+            escaped = s.replace(q, escaped_q)
+            return f"{q}{escaped}{q}"
         return s
 
     @staticmethod
@@ -95,13 +98,13 @@ class Exporter:
                 f.write("| " + " | ".join(clean_cells) + " |\n")
 
     @staticmethod
-    def to_sql_inserts(table_name: str, columns: List[str], rows: List[List[Any]], output_path: str):
+    def to_sql_inserts(table_name: str, columns: List[str], rows: List[List[Any]], output_path: str, dialect: str = "sqlite"):
         table = (table_name or "exported_table").strip()
-        escaped_table = Exporter._escape_ident(table)
-        escaped_cols = [Exporter._escape_ident(c) for c in columns]
+        escaped_table = Exporter._escape_ident(table, dialect=dialect)
+        escaped_cols = [Exporter._escape_ident(c, dialect=dialect) for c in columns]
         cols_str = ", ".join(escaped_cols)
         with open(output_path, "w", encoding="utf-8") as f:
-            f.write(f"-- GhostBase SQL Export: {table}\n")
+            f.write(f"-- GhostBase SQL Export: {table} ({dialect})\n")
             f.write(f"-- Total: {len(rows)} row(s)\n\n")
             for r in rows:
                 vals = []

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.3}/ghostbase_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ghostbase-cli
-Version: 0.1.2
+Version: 0.1.3
 Summary: A fast, keyboard-driven terminal database studio for SQLite, PostgreSQL & MySQL
 Author-email: 4yk5 <contact.4yk5@proton.me>
 License-Expression: MIT

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ghostbase-cli"
-version = "0.1.2"
+version = "0.1.3"
 description = "A fast, keyboard-driven terminal database studio for SQLite, PostgreSQL & MySQL"
 readme = "README.md"
 authors = [{ name = "4yk5", email = "contact.4yk5@proton.me" }]

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.3}/tests/test_vulnerabilities_fixed.py

@@ -41,6 +41,11 @@ def test_safe_mode_and_comment_bypass():
     is_dest, r = db.check_safety(dollar_bypass, is_safe_mode=False)
     assert is_dest, f"VULNERABILITY: Dollar-quoted string containing WHERE fooled check_safety: {r}"
 
+    # Postgres dollar-quoted string with tag mismatch ($tag$ vs $other$)
+    mismatched_tag_query = "UPDATE users SET role = $tag$abc $other$ WHERE marker $tag$;"
+    is_dest, r = db.check_safety(mismatched_tag_query, is_safe_mode=False)
+    assert is_dest, f"VULNERABILITY: Dollar-quoted tag mismatch bypassed WHERE check: {r}"
+
     # Safe Mode STRICT read-only checks
     safe_queries = [
         "SELECT * FROM users WHERE id = 5;",
@@ -52,6 +57,7 @@ def test_safe_mode_and_comment_bypass():
         is_dest, r = db.check_safety(q, is_safe_mode=True)
         assert not is_dest, f"Safe query wrongly blocked in Safe Mode: {q} ({r})"
 
+    # Safe Mode must strictly block DML, DDL, DO blocks, CALL, MERGE, and SET changes
     unsafe_queries = [
         ("UPDATE users SET role = 'Admin' WHERE id = 5;", "UPDATE"),
         ("INSERT INTO users (name) VALUES ('Test');", "INSERT"),
@@ -62,6 +68,11 @@ def test_safe_mode_and_comment_bypass():
         ("CREATE TABLE test (id INT);", "CREATE"),
         ("SELECT nextval('users_id_seq');", "NEXTVAL"),
         ("SELECT * INTO OUTFILE '/tmp/f' FROM users;", "INTO OUTFILE"),
+        ("SET default_transaction_read_only = OFF;", "SET"),
+        ("RESET ALL;", "RESET"),
+        ("DO $body$ BEGIN UPDATE users SET role = 'Admin'; END $body$;", "DO"),
+        ("CALL custom_proc();", "CALL"),
+        ("MERGE INTO target USING source ON target.id = source.id WHEN MATCHED THEN DELETE;", "MERGE"),
     ]
     for q, op in unsafe_queries:
         is_dest, r = db.check_safety(q, is_safe_mode=True)
@@ -72,7 +83,7 @@ def test_safe_mode_and_comment_bypass():
 
 
 def test_database_engine_level_readonly():
-    print("[*] 2. Testing Database Engine-Level Read-Only Enforcement...")
+    print("[*] 2. Testing Database Engine-Level Read-Only & Fail-Closed Enforcement...")
     db = DatabaseEngine(":memory:")
     db.conn.execute("CREATE TABLE read_only_test (id INT, val TEXT);")
     db.conn.commit()
@@ -180,11 +191,12 @@ def test_returning_dml_classification():
     print("  [+] DML with RETURNING Classification: PASS")
 
 
-def test_exporter_dedup_and_ident_escaping():
-    print("[*] 7. Testing Exporter JSON Types & SQL Identifier Escaping...")
+def test_exporter_json_types_and_dialect_sql():
+    print("[*] 7. Testing Exporter JSON Types & Dialect-Aware SQL Escaping (MySQL vs Postgres/SQLite)...")
     tmp = tempfile.gettempdir()
     json_path = os.path.join(tmp, "test_types.json")
-    sql_path = os.path.join(tmp, "test_escape.sql")
+    sql_pg_path = os.path.join(tmp, "test_pg.sql")
+    sql_my_path = os.path.join(tmp, "test_mysql.sql")
 
     # JSON export with Decimal, datetime, UUID, bytes, and duplicate column names
     cols = ["id", "id", "price", "created", "uid", "raw"]
@@ -206,17 +218,24 @@ def test_exporter_dedup_and_ident_escaping():
     assert data[0]["uid"] == "12345678-1234-5678-1234-567812345678"
     assert data[0]["raw"] == "binary_ghost"
 
-    # SQL export schema-qualified tables & reserved words
+    # PostgreSQL / SQLite dialect SQL export (Double quotes)
     table_name = "analytics.order"
     cols_special = ["first name", "group", "price"]
     rows_special = [["Bob", "Admin", decimal.Decimal("10.50")]]
-    Exporter.to_sql_inserts(table_name, cols_special, rows_special, sql_path)
-    with open(sql_path, "r", encoding="utf-8") as f:
-        sql_content = f.read()
+    Exporter.to_sql_inserts(table_name, cols_special, rows_special, sql_pg_path, dialect="postgresql")
+    with open(sql_pg_path, "r", encoding="utf-8") as f:
+        pg_content = f.read()
+
+    assert 'INSERT INTO "analytics"."order" ("first name", "group", price) VALUES (\'Bob\', \'Admin\', 10.50);' in pg_content
+
+    # MySQL dialect SQL export (Backticks)
+    Exporter.to_sql_inserts(table_name, cols_special, rows_special, sql_my_path, dialect="mysql")
+    with open(sql_my_path, "r", encoding="utf-8") as f:
+        my_content = f.read()
 
-    assert 'INSERT INTO "analytics"."order" ("first name", "group", price) VALUES (\'Bob\', \'Admin\', 10.50);' in sql_content
+    assert 'INSERT INTO `analytics`.`order` (`first name`, `group`, price) VALUES (\'Bob\', \'Admin\', 10.50);' in my_content
 
-    print("  [+] Exporter JSON Types & SQL Escaping: PASS")
+    print("  [+] Exporter JSON Types & Dialect-Aware SQL Escaping: PASS")
 
 
 def test_table_quoting_and_cte_export_detection():
@@ -232,6 +251,7 @@ def test_table_quoting_and_cte_export_detection():
     db_my = DatabaseEngine.__new__(DatabaseEngine)
     db_my.db_type = "mysql"
     assert db_my.quote_table_name("order") == "`order`"
+    assert db_my.quote_table_name("analytics.users") == "`analytics`.`users`"
 
     # CTE target detection test
     cte_query = """
@@ -266,7 +286,7 @@ def test_result_set_memory_limit():
 
 def main():
     print("\n" + "=" * 60)
-    print("RUNNING EXHAUSTIVE REFINED VERIFICATION TESTS (v0.1.2)")
+    print("RUNNING EXHAUSTIVE REFINED VERIFICATION TESTS (v0.1.3)")
     print("=" * 60)
 
     test_safe_mode_and_comment_bypass()
@@ -275,12 +295,12 @@ def main():
     test_sqlite_foreign_keys_enforced()
     test_empty_sqlite_not_polluted()
     test_returning_dml_classification()
-    test_exporter_dedup_and_ident_escaping()
+    test_exporter_json_types_and_dialect_sql()
     test_table_quoting_and_cte_export_detection()
     test_result_set_memory_limit()
 
     print("\n" + "=" * 60)
-    print("ALL 9 CRITICAL & HIGH EDGE CASES VERIFIED AND 100% PASSING!")
+    print("ALL ANALYST VULNERABILITIES VERIFIED AND 100% PASSING!")
     print("=" * 60 + "\n")