queryapigate 0.35.0__tar.gz → 0.35.1__tar.gz

{queryapigate-0.35.0/queryapigate.egg-info → queryapigate-0.35.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.35.0
+Version: 0.35.1
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: FSL-1.1-MIT
@@ -84,6 +84,8 @@ Dynamic: license-file
 [![PyPI downloads](https://img.shields.io/pypi/dm/queryapigate.svg)](https://pypi.org/project/queryapigate/)
 [![License: FSL-1.1-MIT](https://img.shields.io/badge/license-FSL--1.1--MIT-blue.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/LICENSE)
 ![Python](https://img.shields.io/badge/python-3.11%2B-blue)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/AnanthaRajuC/QueryAPIGate/badge)](https://scorecard.dev/viewer/?uri=github.com/AnanthaRajuC/QueryAPIGate)
+[![SLSA 2](https://slsa.dev/images/gh-badge-level2.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/SECURITY.md#slsa-level)
 
 ### Turn SQL queries into secure, governed REST APIs.
 

{queryapigate-0.35.0 → queryapigate-0.35.1}/README.md

@@ -6,6 +6,8 @@
 [![PyPI downloads](https://img.shields.io/pypi/dm/queryapigate.svg)](https://pypi.org/project/queryapigate/)
 [![License: FSL-1.1-MIT](https://img.shields.io/badge/license-FSL--1.1--MIT-blue.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/LICENSE)
 ![Python](https://img.shields.io/badge/python-3.11%2B-blue)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/AnanthaRajuC/QueryAPIGate/badge)](https://scorecard.dev/viewer/?uri=github.com/AnanthaRajuC/QueryAPIGate)
+[![SLSA 2](https://slsa.dev/images/gh-badge-level2.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/SECURITY.md#slsa-level)
 
 ### Turn SQL queries into secure, governed REST APIs.
 

{queryapigate-0.35.0 → queryapigate-0.35.1}/queryapigate/__init__.py

@@ -1,5 +1,5 @@
 """QueryAPIGate - expose SQL databases as a REST API."""
-__version__ = "0.35.0"
+__version__ = "0.35.1"
 
 from .app import create_app  # noqa: E402  (app imports __version__)
 

{queryapigate-0.35.0 → queryapigate-0.35.1}/queryapigate/apikeys.py

@@ -450,8 +450,10 @@ def is_expired(entry):
         return False
     try:
         deadline = datetime.strptime(expires_at, '%Y-%m-%d').replace(hour=23, minute=59, second=59)
-    except ValueError:
-        return False  # a malformed stored value should not itself lock the key out
+    except (TypeError, ValueError):
+        # Every way in validates the date (_validate_expiry()), so this is a store edited by hand or damaged: an expiry
+        # nobody can read is treated as passed - fail closed - not as none (review, 2026-10-15)
+        return True
     return datetime.now() > deadline
 
 

{queryapigate-0.35.0 → queryapigate-0.35.1}/queryapigate/auditstream.py

@@ -191,6 +191,7 @@ class _Syslog:
         if parts.scheme != 'tls':
             return raw
         context = ssl.create_default_context(cafile=os.environ.get('QUERYAPIGATE_AUDIT_SYSLOG_CA', '').strip() or None)
+        context.minimum_version = ssl.TLSVersion.TLSv1_2  # the default; said, so nothing lowers it
         cert = os.environ.get('QUERYAPIGATE_AUDIT_SYSLOG_CERT', '').strip()
         if cert:
             context.load_cert_chain(cert, os.environ.get('QUERYAPIGATE_AUDIT_SYSLOG_KEY', '').strip())

{queryapigate-0.35.0 → queryapigate-0.35.1}/queryapigate/console.py

@@ -8,9 +8,11 @@ built it gets a short "not built" page instead of an error - backend work never
 The page itself is public and holds no data: everything it shows comes from the JSON API, called with the API key the
 user enters (kept in sessionStorage under the same name /docs uses).
 """
+import os
 from pathlib import Path
 
 from flask import Response, send_from_directory
+from werkzeug.security import safe_join
 
 DIST = Path(__file__).parent / 'console_dist'
 
@@ -59,7 +61,10 @@ def serve(path=''):
     asset reference fails visibly instead of loading HTML as a script."""
     if not built():
         return _secure(Response(NOT_BUILT_HTML, mimetype='text/html'))
-    if path and (DIST / path).is_file():
+    # Only what's inside the build is looked at: checking the raw path told a caller whether a file existed anywhere
+    # on the server - 404 for one that did, the index for one that didn't (CodeQL py/path-injection).
+    inside = safe_join(str(DIST), path) if path else None
+    if inside is not None and os.path.isfile(inside):
         response = send_from_directory(DIST, path, max_age=0)
         if path.startswith('assets/'):  # content-hashed file names: safe to cache forever
             response.headers['Cache-Control'] = 'public, max-age=31536000, immutable'

{queryapigate-0.35.0 → queryapigate-0.35.1}/queryapigate/logging_setup.py

@@ -39,6 +39,20 @@ class _RequestContextFilter(logging.Filter):
         return True
 
 
+class _PlainFormatter(logging.Formatter):
+    """One event, one line: a line break in the message - a caller's SQL, a request path with %0A in it - is written
+    as \\n, so it can't start what reads as a log line of its own (CodeQL py/log-injection). A traceback keeps its
+    lines: it comes after the message, from the server, not a caller."""
+
+    def formatMessage(self, record):
+        message = record.message
+        record.message = message.replace('\\', '\\\\').replace('\r', '\\r').replace('\n', '\\n')
+        try:
+            return super().formatMessage(record)
+        finally:
+            record.message = message
+
+
 class _JsonFormatter(logging.Formatter):
     def format(self, record):
         payload = {
@@ -72,7 +86,7 @@ def configure(logger):
     handler = logging.StreamHandler()
     handler._queryapigate_managed = True
     handler.addFilter(_RequestContextFilter())
-    handler.setFormatter(_JsonFormatter() if config.json_logs() else logging.Formatter(_PLAIN_FORMAT))
+    handler.setFormatter(_JsonFormatter() if config.json_logs() else _PlainFormatter(_PLAIN_FORMAT))
     logger.addHandler(handler)
     logger.setLevel(logging.INFO)
     logger.propagate = False

{queryapigate-0.35.0 → queryapigate-0.35.1}/queryapigate/runners.py

@@ -546,6 +546,10 @@ class _H2(_Driver):
 
     def connect(self, details, read_only):
         import jaydebeapi
+        if not os.path.isfile(config.h2_jar()):  # a source checkout: the driver is fetched, not committed
+            raise ApiError(f"H2's driver isn't installed ({config.h2_jar()}): in a source checkout run "
+                           'python .github/scripts/fetch_h2_jar.py, or set QUERYAPIGATE_H2_JAR', 500,
+                           code='driver_missing')
         _attach_thread_as_daemon()
         host = details.get('host') or 'localhost'
         if details.get('port') and ':' not in host:

{queryapigate-0.35.0 → queryapigate-0.35.1}/queryapigate/sqltools.py

@@ -96,6 +96,10 @@ def write_operations(sql, dialect=None):
     if keyword == 'explain':
         inner = _EXPLAIN_RE.sub('', masked, count=1)
         inner_keyword = first_keyword(inner, dialect)
+        if inner_keyword == 'explain':
+            # No database runs EXPLAIN EXPLAIN: refused as a write (fails closed) rather than looked into again - each
+            # level was a recursion re-scanning the whole text, so thousands of them raised RecursionError (fuzzing).
+            return {'explain'}
         if inner_keyword in READ_ONLY_STATEMENTS:
             return write_operations(inner, dialect)
         return {inner_keyword} if inner_keyword in _WRITE_KEYWORDS else set()
@@ -144,7 +148,11 @@ def validate_sql(sql, dialect=None, allow_writes=None, allowed_write_ops=None, a
     """
     if not isinstance(sql, str) or not sql.strip():
         raise ApiError('SQL query is missing', code='sql_required')
-    sql = re.sub(r'[\s;]+$', '', sql.strip())
+    sql = sql.strip()
+    end = len(sql)  # trailing whitespace and semicolons, from the end: `[\s;]+$` was quadratic in a long inner run
+    while end and (sql[end - 1] == ';' or sql[end - 1].isspace()):
+        end -= 1
+    sql = sql[:end]
     if ';' in _literals_re(dialect).sub(' ', sql):
         raise ApiError('Only a single SQL statement can be executed at a time', code='multiple_statements')
     # Every write the statement performs - including one hidden behind a read-only first keyword (a writable CTE,

{queryapigate-0.35.0 → queryapigate-0.35.1}/queryapigate/store.py

@@ -8,6 +8,7 @@ filesystem path.
 """
 import contextlib
 import json
+import logging
 import os
 import re
 import threading
@@ -119,7 +120,9 @@ def record_audit(actor, action, target, changes=None, via=None):
             # several instances still make one chain
             link = auditchain.append(conn, entry, config.audit_log_limit())
     except (OSError, *db.Error):
-        pass
+        # The action stands, but it has no entry: said loudly, never silently (review, 2026-10-15)
+        logging.getLogger('queryapigate').error('Audit log: %s on %s by %s happened, but its entry could not be '
+                                                'written', action, target, actor, exc_info=True)
 
     def deliver():
         from . import auditstream

{queryapigate-0.35.0 → queryapigate-0.35.1}/queryapigate/tableguard.py

@@ -3,12 +3,13 @@ dialects sqlglot can parse (see ``_DIALECT_MAP``). Unlike sqlflow.py's best-effo
 extraction for the Access tab's visualization, this one is a security check: a query whose tables can't be
 verified - an unsupported dialect, a parse failure - must be rejected, not silently let through.
 
-Extraction is ``parsed.find_all(exp.Table)`` minus any CTE names defined in the same query, not
-``sqlglot.optimizer.scope.build_scope()`` - the latter correctly excludes CTE names for SELECT/WITH but
-returns None entirely for DELETE/UPDATE/INSERT (verified directly against a real sqlglot install), which
-would silently miss a write statement's own target table. The simpler find_all()-minus-CTE-names approach
-was verified to give correct results uniformly across CTEs, subqueries, UNION, self-joins, and bare or
-CTE'd DELETE/UPDATE/INSERT - one code path for every statement type this guard needs to check, not two.
+Extraction walks the parsed statement keeping track of which CTEs are visible where (``_real_tables``), not
+``sqlglot.optimizer.scope.build_scope()`` - that returns None entirely for DELETE/UPDATE/INSERT (verified against a
+real sqlglot install), which would silently miss a write statement's own target table. A bare name refers to a CTE
+only where SQL says it does: in the statement after its WITH, in the CTEs defined after it - and in its own body
+only under WITH RECURSIVE. Anywhere else, and always when qualified (``public.secret``), it's the table: dropping
+every table that merely shared a CTE's name let `WITH secret AS (SELECT * FROM secret) SELECT * FROM secret` past a
+key allowed only `orders` (fixed 2026-10-15).
 
 Known, accepted limitations: a table name is extracted bare (``information_schema.tables`` -> ``'tables'``),
 not schema-qualified - matches allowed_write_ops's own bare-keyword-list style, but can't disambiguate two
@@ -48,8 +49,43 @@ def extract_tables(sql, dialect):
             name = function.sql_name().lower() if not isinstance(function, exp.Anonymous) else function.name.lower()
             raise ApiError(f'This API key may only query its allowed tables - a table function such as {name}() '
                            "reads data the allow-list can't see, so it isn't allowed", 403, code='table_not_allowed')
-    cte_names = {cte.alias_or_name for cte in parsed.find_all(exp.CTE)}
-    return {t.name.lower() for t in parsed.find_all(exp.Table) if t.name and t.name not in cte_names}
+    try:
+        return _real_tables(parsed, frozenset())
+    except RecursionError:  # nested deeper than can be walked: refused, never let through
+        raise ApiError('This query could not be analyzed to enforce its table access restrictions', 403,
+                       code='table_check_failed') from None
+
+
+def _real_tables(node, visible):
+    """The tables under ``node`` that aren't references to a CTE in ``visible`` (lower-case names) - see the
+    module docstring for the scoping rule."""
+    from sqlglot import exp
+    if isinstance(node, exp.Table):
+        name = node.name.lower()
+        if not name or (name in visible and not node.args.get('db') and not node.args.get('catalog')):
+            return set()
+        return {name} | _children(node, visible)
+    found = set()
+    with_ = node.args.get('with') if isinstance(node, exp.Expression) else None
+    if isinstance(with_, exp.With):
+        ctes = [(cte.alias_or_name.lower(), cte.this) for cte in with_.expressions]
+        if with_.args.get('recursive'):
+            visible = visible | {name for name, _ in ctes}
+            for _, body in ctes:
+                found |= _real_tables(body, visible)
+        else:
+            for name, body in ctes:  # each body sees the CTEs before it, not itself or those after
+                found |= _real_tables(body, visible)
+                visible = visible | {name}
+    return found | _children(node, visible, skip=with_)
+
+
+def _children(node, visible, skip=None):
+    found = set()
+    for child in node.iter_expressions():
+        if child is not skip:
+            found |= _real_tables(child, visible)
+    return found
 
 
 # Table functions that only generate values - no data to restrict - and so stay usable with allowed_tables.

{queryapigate-0.35.0 → queryapigate-0.35.1/queryapigate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.35.0
+Version: 0.35.1
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: FSL-1.1-MIT
@@ -84,6 +84,8 @@ Dynamic: license-file
 [![PyPI downloads](https://img.shields.io/pypi/dm/queryapigate.svg)](https://pypi.org/project/queryapigate/)
 [![License: FSL-1.1-MIT](https://img.shields.io/badge/license-FSL--1.1--MIT-blue.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/LICENSE)
 ![Python](https://img.shields.io/badge/python-3.11%2B-blue)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/AnanthaRajuC/QueryAPIGate/badge)](https://scorecard.dev/viewer/?uri=github.com/AnanthaRajuC/QueryAPIGate)
+[![SLSA 2](https://slsa.dev/images/gh-badge-level2.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/SECURITY.md#slsa-level)
 
 ### Turn SQL queries into secure, governed REST APIs.
 

{queryapigate-0.35.0 → queryapigate-0.35.1}/tests/test_api_keys.py

@@ -949,6 +949,11 @@ class ApiKeysModuleTests(unittest.TestCase):
                                    rate_limit=None, allowed_write_ops=None)
         self.assertTrue(apikeys.can_write_query(admin, 'anything'))
 
+    def test_an_expiry_nobody_can_read_counts_as_passed(self):
+        for bad in ('not-a-date', '2026-13-40', 20261015):
+            with self.subTest(bad=bad):
+                self.assertTrue(apikeys.is_expired({'expires_at': bad}))
+
     def test_is_expired(self):
         yesterday = (datetime.now() - timedelta(days=1)).strftime('%Y-%m-%d')
         tomorrow = (datetime.now() + timedelta(days=1)).strftime('%Y-%m-%d')
@@ -1042,4 +1047,4 @@ class CatalogTests(AppTestCase):
     def test_requires_authentication_like_any_other_functional_endpoint(self):
         self.assertEqual(self.client.get('/catalog').status_code, 401)
         self.assertEqual(self.client.get('/catalog', headers={'X-API-Key': 'wrong'}).status_code, 401)
-        self.assertFalse(apikeys.is_expired({'expires_at': 'garbage'}))  # malformed shouldn't lock the key out
+        self.assertTrue(apikeys.is_expired({'expires_at': 'garbage'}))  # unreadable: fails closed (2026-10-15)

{queryapigate-0.35.0 → queryapigate-0.35.1}/tests/test_console.py

@@ -84,6 +84,13 @@ class BuiltTests(ConsoleTestCase):
             res = self.get(path)
             self.assertNotIn('do not serve', res.get_data(as_text=True), path)
 
+    def test_whether_a_file_outside_exists_isnt_told_either(self):
+        # CodeQL py/path-injection: the check before send_from_directory() looked outside the build, so a file that
+        # existed there answered 404 and one that didn't the Console's index - which file is on the server, told.
+        (Path(self.tmp.name) / 'LICENSE').write_text('outside')
+        there, missing = self.get('/console/%2e%2e/LICENSE'), self.get('/console/%2e%2e/NO_SUCH_FILE')
+        self.assertEqual((there.status_code, there.get_data()), (missing.status_code, missing.get_data()))
+
     def test_every_response_carries_a_strict_content_security_policy(self):
         for path in ('/console/', '/console/queries', '/console/assets/index-abc123.js',
                      '/console/assets/missing-999.js'):

{queryapigate-0.35.0 → queryapigate-0.35.1}/tests/test_observability.py

@@ -153,6 +153,22 @@ class LoggingFormatTests(unittest.TestCase):
         _, handler = self._handler_for('queryapigate_test_plain', json_logs=False)
         self.assertNotIsInstance(handler.formatter, logging_setup._JsonFormatter)
 
+    def test_a_line_break_in_a_message_cant_forge_a_line_of_its_own(self):
+        # CodeQL py/log-injection: a caller's SQL (or a request path with %0A) is in the message; in plain text a line
+        # break there could start what reads as another event. A traceback keeps its own lines.
+        logger, handler = self._handler_for('queryapigate_test_inject', json_logs=False)
+        buf = io.StringIO()
+        handler.stream = buf
+        logger.warning('Executing: %s', "SELECT 1\n2026-10-15 07:00:00 INFO queryapigate [- key=admin]: forged\\n")
+        try:
+            raise ValueError('boom')
+        except ValueError:
+            logger.exception('failed')
+        lines = buf.getvalue().splitlines()
+        self.assertTrue(lines[0].endswith(r"SELECT 1\n2026-10-15 07:00:00 INFO queryapigate [- key=admin]: forged\\n"))
+        self.assertFalse(any(line.startswith('2026-10-15 07:00:00 INFO') for line in lines))
+        self.assertIn('Traceback (most recent call last):', lines)  # the server's own lines, as they were
+
     def test_json_when_enabled(self):
         logger, handler = self._handler_for('queryapigate_test_json', json_logs=True)
         self.assertIsInstance(handler.formatter, logging_setup._JsonFormatter)

{queryapigate-0.35.0 → queryapigate-0.35.1}/tests/test_queryapigate.py

@@ -794,6 +794,7 @@ class DriverWiringTests(unittest.TestCase):
 
     def test_h2_sets_query_timeout_and_maps_cancellation(self):
         import jaydebeapi
+        self.enterContext(mock.patch.object(config, 'h2_jar', return_value=__file__))  # any file: the JVM is mocked
         cursor = mock.MagicMock()
         cursor.description = [('C',)]
         cursor.execute.side_effect = [None, jaydebeapi.DatabaseError('Statement was canceled or the session timed out')]
@@ -1038,7 +1039,16 @@ class PooledDriverTests(unittest.TestCase):
         with mock.patch('jpype.isJVMStarted', return_value=False):  # nothing to attach to before the JVM starts
             runners._attach_thread_as_daemon()
 
+    def test_h2_without_its_driver_says_how_to_get_it(self):
+        with mock.patch.object(config, 'h2_jar', return_value='/nowhere/h2.jar'), \
+                mock.patch('jaydebeapi.connect') as connect, self.assertRaises(ApiError) as caught:
+            runners._H2().connect({'host': 'h', 'database': 'd'}, True)
+        self.assertEqual((caught.exception.status, caught.exception.code), (500, 'driver_missing'))
+        self.assertIn('fetch_h2_jar.py', caught.exception.message)
+        self.assertFalse(connect.called)
+
     def test_h2_dead_connection_is_replaced(self):
+        self.enterContext(mock.patch.object(config, 'h2_jar', return_value=__file__))  # any file: the JVM is mocked
         first, second = mock.MagicMock(), mock.MagicMock()
         for conn in (first, second):
             conn.cursor.return_value.description = [('C',)]

{queryapigate-0.35.0 → queryapigate-0.35.1}/tests/test_release_check.py

@@ -64,6 +64,18 @@ class ReleaseCheckTests(unittest.TestCase):
         (self.root / 'CHANGELOG.md').unlink()
         self.assertEqual(len(check_release.problems('v0.2.0', self.root)), 2)
 
+    def test_the_release_notes_are_the_versions_changelog_section(self):
+        (self.root / 'CHANGELOG.md').write_text(
+            '## [Unreleased]\n\n## [0.3.0] - 2026-10-14\n\nNewer.\n\n## [0.2.0] - 2026-09-21\n\nThe summary.\n\n'
+            '### Fixed\n- a thing\n\n[Unreleased]: https://example.com/compare\n')
+        self.assertEqual(check_release.notes('v0.2.0', self.root), 'The summary.\n\n### Fixed\n- a thing\n')
+        self.assertEqual(check_release.notes('v0.3.0', self.root), 'Newer.\n')
+        with self.assertRaises(SystemExit):
+            check_release.notes('v9.9.9', self.root)
+        out = subprocess.run(['python3', str(SCRIPT), '--notes', 'v0.3.0'], cwd=self.root, capture_output=True,
+                             text=True)
+        self.assertEqual((out.returncode, out.stdout), (0, 'Newer.\n'))
+
     def test_command_line_exit_codes(self):
         run = lambda tag: subprocess.run(['python3', str(SCRIPT), tag], cwd=self.root,  # noqa: E731
                                          capture_output=True, text=True)

{queryapigate-0.35.0 → queryapigate-0.35.1}/tests/test_sql_guard_fuzz.py

@@ -385,3 +385,22 @@ class PaginateFuzzTests(unittest.TestCase):
 
 if __name__ == '__main__':
     unittest.main()
+
+
+class LinearTimeTests(unittest.TestCase):
+    """CodeQL (py/polynomial-redos, 2026-10-15): validate_sql stripped trailing whitespace and semicolons with
+    `[\\s;]+$`, which a regex engine retries from every position of a long run that isn't at the end - 40,000 spaces
+    took three seconds, a few hundred thousand a minute, in any caller's ad-hoc SQL."""
+
+    def test_a_long_run_of_spaces_is_linear(self):
+        import time
+        started = time.monotonic()
+        sqltools.validate_sql('SELECT 1' + ' ' * 200_000 + 'AS x', 'postgres', allow_writes=False)
+        self.assertLess(time.monotonic() - started, 0.5)
+
+    def test_trailing_whitespace_and_semicolons_still_go(self):
+        for sql, expected in (('SELECT 1;', 'SELECT 1'), ('SELECT 1 ; ;\n\t ', 'SELECT 1'),
+                              ('SELECT 1 ;', 'SELECT 1'), ('  SELECT 1', 'SELECT 1'),
+                              ("SELECT ';'", "SELECT ';'")):
+            with self.subTest(sql=sql):
+                self.assertEqual(sqltools.validate_sql(sql, 'postgres', allow_writes=False), expected)

{queryapigate-0.35.0 → queryapigate-0.35.1}/tests/test_sql_guard_writes.py

@@ -62,6 +62,21 @@ class RuleTests(unittest.TestCase):
             with self.subTest(sql=sql):
                 self.assertEqual(sqltools.write_operations(sql, dialect), set())
 
+    def test_explain_inside_explain_is_refused_not_recursed_into(self):
+        # Found by fuzzing (fuzz/fuzz_sql_guard.py): each EXPLAIN was one more level of recursion, re-scanning the
+        # whole text - a few thousand in one statement raised RecursionError (a 500) after quadratic work. No database
+        # runs EXPLAIN EXPLAIN, so it's refused as a write, failing closed, and nothing deeper is looked at.
+        import time
+        started = time.monotonic()
+        for sql in ('EXPLAIN EXPLAIN SELECT 1', 'explain ' * 5000 + 'SELECT 1', 'EXPLAIN ANALYZE EXPLAIN SELECT 1'):
+            with self.subTest(sql=sql[:40]):
+                self.assertEqual(sqltools.write_operations(sql, 'postgres'), {'explain'})
+                with self.assertRaises(Exception) as caught:
+                    sqltools.validate_sql(sql, 'postgres', allow_writes=False)
+                self.assertEqual(caught.exception.code, 'read_only')
+        self.assertLess(time.monotonic() - started, 2)
+        self.assertEqual(sqltools.write_operations('EXPLAIN SELECT 1', 'postgres'), set())  # one level still reads
+
     def test_allowed_write_ops_cover_hidden_writes_too(self):
         sql = 'WITH d AS (DELETE FROM t RETURNING *) SELECT * FROM d'
         with self.assertRaises(Exception) as caught:

{queryapigate-0.35.0 → queryapigate-0.35.1}/tests/test_supply_chain.py

@@ -102,3 +102,44 @@ class SignedTests(unittest.TestCase):
 
 if __name__ == '__main__':
     unittest.main()
+
+
+class H2DriverTests(unittest.TestCase):
+    """The H2 driver the package bundles isn't committed (OpenSSF Scorecard: Binary-Artifacts): the fetch script and
+    the Dockerfile each download it from Maven Central, checked against a pinned SHA-256 - the same one."""
+
+    def setUp(self):
+        import importlib.util
+        spec = importlib.util.spec_from_file_location(
+            'fetch_h2_jar', os.path.join(ROOT, '.github', 'scripts', 'fetch_h2_jar.py'))
+        self.fetch = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(self.fetch)
+
+    def test_the_dockerfile_fetches_the_same_file_with_the_same_hash(self):
+        with open(os.path.join(ROOT, 'Dockerfile')) as f:
+            dockerfile = f.read()
+        added = re.search(r'ADD --chmod=644 --checksum=sha256:([0-9a-f]{64}) \\\n\s+(\S+) (\S+)', dockerfile)
+        self.assertIsNotNone(added, 'the Dockerfile fetches the H2 driver with ADD --checksum')
+        self.assertEqual(added.groups(), (self.fetch.SHA256, self.fetch.URL,
+                                          f'./queryapigate/lib/h2-{self.fetch.VERSION}.jar'))
+
+    def test_the_server_looks_for_the_version_fetched(self):
+        from queryapigate import config
+        self.assertEqual(config.BUNDLED_H2_JAR.resolve(), self.fetch.TARGET)
+
+    def test_a_download_with_another_hash_is_never_written(self):
+        import io
+        import tempfile
+        from contextlib import redirect_stderr
+        from pathlib import Path
+        from unittest import mock
+        with tempfile.TemporaryDirectory() as tmp:
+            target = Path(tmp) / 'h2.jar'
+            response = mock.MagicMock()
+            response.__enter__.return_value.read.return_value = b'not the driver'
+            with mock.patch.object(self.fetch, 'TARGET', target), \
+                    mock.patch.object(self.fetch.urllib.request, 'urlopen', return_value=response), \
+                    redirect_stderr(io.StringIO()) as err:
+                self.assertEqual(self.fetch.main(), 1)
+            self.assertFalse(target.exists())
+            self.assertIn('not written', err.getvalue())

{queryapigate-0.35.0 → queryapigate-0.35.1}/tests/test_tableguard.py

@@ -26,6 +26,36 @@ class ExtractTablesTests(unittest.TestCase):
               'WHERE r.id IN (SELECT order_id FROM refunds)')
         self.assertEqual(tableguard.extract_tables(sql, 'postgres'), {'orders', 'customers', 'refunds'})
 
+    def test_a_cte_named_after_the_table_it_reads_still_counts_that_table(self):
+        # Found by review, 2026-10-15: every table sharing a name with a CTE was dropped, the one the CTE itself reads
+        # included - so `WITH secret AS (SELECT * FROM secret) SELECT * FROM secret` named no table at all, and a key
+        # allowed only `orders` read `secret`. Inside its own definition a (non-recursive) CTE's name is the table.
+        for sql, tables in (
+                ('WITH secret AS (SELECT * FROM secret) SELECT * FROM secret', {'secret'}),
+                ('WITH Secret AS (SELECT * FROM secret) SELECT * FROM SECRET', {'secret'}),
+                ('WITH a AS (SELECT * FROM b), b AS (SELECT 1 AS n) SELECT * FROM a, b', {'b'}),  # b: not yet
+                ('WITH b AS (SELECT * FROM orders), a AS (SELECT * FROM b) SELECT * FROM a', {'orders'}),
+                ('WITH secret AS (SELECT 1 AS n) SELECT * FROM public.secret', {'secret'}),  # qualified: the table
+                ('SELECT * FROM (WITH secret AS (SELECT * FROM secret) SELECT * FROM secret) x', {'secret'}),
+                ('WITH x AS (SELECT 1 AS n) SELECT * FROM (WITH y AS (SELECT * FROM x) SELECT * FROM y) z', set()),
+                ('WITH RECURSIVE n AS (SELECT 1 AS i UNION ALL SELECT i + 1 FROM n WHERE i < 3) SELECT * FROM n',
+                 set())):  # a recursive CTE reads itself, not a table
+            with self.subTest(sql=sql):
+                self.assertEqual(tableguard.extract_tables(sql, 'postgres'), tables)
+        with self.assertRaises(ApiError) as caught:
+            sqltools.validate_sql('WITH secret AS (SELECT * FROM secret) SELECT * FROM secret', 'postgres',
+                                  allow_writes=False, allowed_tables={'orders'})
+        self.assertEqual(caught.exception.code, 'table_not_allowed')
+
+    def test_a_statement_nested_too_deep_to_walk_is_refused_not_let_through(self):
+        for depth in (50, 400, 3000):
+            sql = 'SELECT * FROM ' + '(SELECT * FROM ' * depth + 'secret' + ') x' * depth
+            with self.subTest(depth=depth):
+                try:
+                    self.assertEqual(tableguard.extract_tables(sql, 'postgres'), {'secret'})
+                except ApiError as error:
+                    self.assertEqual(error.code, 'table_check_failed')
+
     def test_a_derived_table_subquery_resolves_to_its_real_table(self):
         sql = 'SELECT * FROM (SELECT * FROM secret_table) x'
         self.assertEqual(tableguard.extract_tables(sql, 'postgres'), {'secret_table'})