sql-data-guard 0.0.40__tar.gz

sql_data_guard-0.0.40/LICENSE.md

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2025 Imperva
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

sql_data_guard-0.0.40/PKG-INFO

@@ -0,0 +1,153 @@
+Metadata-Version: 2.4
+Name: sql-data-guard
+Version: 0.0.40
+Summary: Safety Layer for LLM Database Interactions
+Author-email: Imperva - Threat Reseach Infra <ww.dis.imperva.threat-research-infra@thalesgroup.com>
+License: MIT License
+        
+        Copyright (c) 2025 Imperva
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+Project-URL: Homepage, https://github.com/ThalesGroup/sql-data-guard
+Project-URL: Issues, https://github.com/ThalesGroup/sql-data-guard/issues
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE.md
+Requires-Dist: sqlglot
+Dynamic: license-file
+
+
+# sql-data-guard: Safety Layer for LLM Database Interactions
+
+<div style="text-align: center;">
+    <img alt="SQL Data Guard logo" src="https://github.com/ThalesGroup/sql-data-guard/blob/main/sql-data-guard-logo.png" width="300"/>
+</div>
+
+SQL is the go-to language for performing queries on databases, and for a good reason - it’s well known, easy to use and pretty simple. However, it seems that it’s as easy to use as it is to exploit, and SQL injection is still one of the most targeted vulnerabilities - especially nowadays with the proliferation of “natural language queries” harnessing Large Language Models (LLMs) power to generate and run SQL queries.
+
+
+To help solve this problem, we developed sql-data-guard, an open-source project designed to verify that SQL queries access only the data they are allowed to. It takes a query and a restriction configuration, and returns whether the query is allowed to run or not. Additionally, it can modify the query to ensure it complies with the restrictions. sql-data-guard has also a built-in module for detection of malicious payloads, allowing it to report on and remove malicious expressions before query execution.
+
+
+sql-data-guard is particularly useful when constructing SQL queries with LLMs, as such queries can’t run as prepared statements. Prepared statements secure a query’s structure, but LLM-generated queries are dynamic and lack this fixed form, increasing SQL injection risk. sql-data-guard mitigates this by inspecting and validating the query's content.
+
+
+By verifying and modifying queries before they are executed, sql-data-guard helps prevent unauthorized data access and accidental data exposure. Adding sql-data-guard to your application can prevent or minimize data breaches and the impact of SQL injection attacks, ensuring that only permitted data is accessed. 
+
+
+Connecting LLMs to SQL databases without strict controls can risk accidental data exposure, as models may generate SQL queries that access sensitive information. OWASP highlights cases of poor sandboxing leading to unauthorized disclosures, emphasizing the need for clear access controls and prompt validation. Businesses should adopt rigorous access restrictions, regular audits, and robust API security, especially to comply with privacy laws and regulations like GDPR and CCPA, which penalize unauthorized data exposure.
+
+## Why Use sql-data-guard?
+
+Consider using sql-guard if your application constructs SQL queries, and you need to ensure that only permitted data is accessed. This is particularly beneficial if:
+- Your application generates complex SQL queries.
+- Your application employs LLM (Large Language Models) to create SQL queries, making it difficult to fully control the queries.
+- Different application users and roles should have different permissions, and you need to correlate an application user or role with fine-grained data access permission.
+- In multi-tenant applications, you need to ensure that each tenant can access only their data, which requires row-level security and often cannot be done using the database permissions model.
+
+sql-guard does not replace the database permissions model. Instead, it adds an extra layer of security, which is crucial when implementing fine-grained, column-level, and row-level security is challenging or impossible. 
+Data restrictions are often complex and cannot be expressed by the database permissions model. For instance, you may need to restrict access to specific columns or rows based on intricate business logic, which many database implementations do not support. Instead of relying on the database to enforce these restrictions, sql-guard helps you overcome vendor-specific limitations by verifying and modifying queries before they are executed.
+
+## How It Works
+
+1. **Input**: sql-data-guard takes an SQL query and a restriction configuration as input.
+2. **Verification**: It verifies whether the query complies with the restrictions specified in the configuration.
+3. **Modification**: If the query does not comply, sql-data-guard can modify the query to ensure it meets the restrictions.
+4. **Output**: It returns whether the query is allowed to run or not, and if necessary, the modified query.
+
+sql-data-guard is designed to be easy to integrate into your application. It provides a simple API that you can call to verify and modify SQL queries before they are executed. You can integrate it using REST API or directly in your application code. 
+
+## Example
+
+Below you can find a Python snippet with allowed data access configuration, and usage of sql-data-guard. sql-data-guard finds a restricted column and an “always-true” possible injection and removes them both. It also adds a missing data restriction:
+
+```python
+from sql_data_guard import verify_sql
+
+config = {
+    "tables": [
+        {
+            "name": "orders",
+            "columns": ["id", "product_name", "account_id"],
+            "restrictions": [{"column": "account_id", "value": 123}]
+        }
+    ] 
+}
+
+query = "SELECT id, name FROM orders WHERE 1 = 1"
+result = verify_sql(query, config)
+print(result)
+```
+Output:
+```json
+{
+    "allowed": false,
+    "errors": ["Column name not allowed. Column removed from SELECT clause", 
+      "Always-True expression is not allowed", "Missing restriction for table: orders column: account_id value: 123"],
+    "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"
+}
+```
+Here is a table with more examples of SQL queries and their corresponding JSON outputs:
+
+| SQL Query                                               | JSON Output                                                                                                                                                                         |
+|---------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| SELECT id, product_name FROM orders WHERE account_id = 123 | { "allowed": true, "errors": [], "fixed": null }                                                                                                                                    |
+| SELECT id FROM orders WHERE account_id = 456            | { "allowed": false, "errors": ["Missing restriction for table: orders column: account_id value: 123"], "fixed": "SELECT id FROM orders WHERE account_id = 456 AND account_id = 123" } |
+| SELECT id, col FROM orders WHERE account_id = 123      | { "allowed": false, "errors": ["Column col is not allowed. Column removed from SELECT clause"], "fixed": "SELECT id FROM orders WHERE account_id = 123" } ```               |
+| SELECT id FROM orders WHERE account_id = 123 OR 1 = 1 | { "allowed": false, "errors": ["Always-True expression is not allowed"], "fixed": "SELECT id FROM orders WHERE account_id = 123" }                                                  |
+|SELECT * FROM orders WHERE account_id = 123| {"allowed": false, "errors": ["SELECT * is not allowed"], "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"}                                |
+```
+
+
+This table provides a variety of SQL queries and their corresponding JSON outputs, demonstrating how `sql-data-guard` handles different scenarios.
+
+## Installation
+To install sql-data-guard, use pip:
+
+```bash
+pip install sql-data-guard
+```
+
+## Docker Repository
+
+sql-data-guard is also available as a Docker image, which can be used to run the application in a containerized environment. This is particularly useful for deployment in cloud environments or for maintaining consistency across different development setups.
+
+### Running the Docker Container
+
+To run the sql-data-guard Docker container, use the following command:
+
+```bash
+docker run -d --name sql-data-guard -p 5000:5000 ghcr.io/thalesgroup/sql-data-guard
+
+### Calling the Docker Container Using REST API
+
+Once the `sql-data-guard` Docker container is running, you can interact with it using its REST API. Below is an example of how to verify an SQL query using `curl`:
+
+```bash
+curl -X POST http://localhost:5000/verify-sql \
+     -H "Content-Type: application/json" \
+     -d '{
+           "sql": "SELECT * FROM orders WHERE account_id = 123",
+           "config": {
+             "tables": [
+               {
+                 "table_name": "orders",
+                 "columns": ["id", "product_name", "account_id"],
+                 "restrictions": [{"column": "account_id", "value": 123}]
+               }             
+            ]
+           }
+         }'
+```
+
+## Contributing
+We welcome contributions! Please see our [CONTRIBUTING.md](CONTRIBUTING.md) for more details.
+
+## License
+This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.

sql_data_guard-0.0.40/README.md

@@ -0,0 +1,129 @@
+
+# sql-data-guard: Safety Layer for LLM Database Interactions
+
+<div style="text-align: center;">
+    <img alt="SQL Data Guard logo" src="https://github.com/ThalesGroup/sql-data-guard/blob/main/sql-data-guard-logo.png" width="300"/>
+</div>
+
+SQL is the go-to language for performing queries on databases, and for a good reason - it’s well known, easy to use and pretty simple. However, it seems that it’s as easy to use as it is to exploit, and SQL injection is still one of the most targeted vulnerabilities - especially nowadays with the proliferation of “natural language queries” harnessing Large Language Models (LLMs) power to generate and run SQL queries.
+
+
+To help solve this problem, we developed sql-data-guard, an open-source project designed to verify that SQL queries access only the data they are allowed to. It takes a query and a restriction configuration, and returns whether the query is allowed to run or not. Additionally, it can modify the query to ensure it complies with the restrictions. sql-data-guard has also a built-in module for detection of malicious payloads, allowing it to report on and remove malicious expressions before query execution.
+
+
+sql-data-guard is particularly useful when constructing SQL queries with LLMs, as such queries can’t run as prepared statements. Prepared statements secure a query’s structure, but LLM-generated queries are dynamic and lack this fixed form, increasing SQL injection risk. sql-data-guard mitigates this by inspecting and validating the query's content.
+
+
+By verifying and modifying queries before they are executed, sql-data-guard helps prevent unauthorized data access and accidental data exposure. Adding sql-data-guard to your application can prevent or minimize data breaches and the impact of SQL injection attacks, ensuring that only permitted data is accessed. 
+
+
+Connecting LLMs to SQL databases without strict controls can risk accidental data exposure, as models may generate SQL queries that access sensitive information. OWASP highlights cases of poor sandboxing leading to unauthorized disclosures, emphasizing the need for clear access controls and prompt validation. Businesses should adopt rigorous access restrictions, regular audits, and robust API security, especially to comply with privacy laws and regulations like GDPR and CCPA, which penalize unauthorized data exposure.
+
+## Why Use sql-data-guard?
+
+Consider using sql-guard if your application constructs SQL queries, and you need to ensure that only permitted data is accessed. This is particularly beneficial if:
+- Your application generates complex SQL queries.
+- Your application employs LLM (Large Language Models) to create SQL queries, making it difficult to fully control the queries.
+- Different application users and roles should have different permissions, and you need to correlate an application user or role with fine-grained data access permission.
+- In multi-tenant applications, you need to ensure that each tenant can access only their data, which requires row-level security and often cannot be done using the database permissions model.
+
+sql-guard does not replace the database permissions model. Instead, it adds an extra layer of security, which is crucial when implementing fine-grained, column-level, and row-level security is challenging or impossible. 
+Data restrictions are often complex and cannot be expressed by the database permissions model. For instance, you may need to restrict access to specific columns or rows based on intricate business logic, which many database implementations do not support. Instead of relying on the database to enforce these restrictions, sql-guard helps you overcome vendor-specific limitations by verifying and modifying queries before they are executed.
+
+## How It Works
+
+1. **Input**: sql-data-guard takes an SQL query and a restriction configuration as input.
+2. **Verification**: It verifies whether the query complies with the restrictions specified in the configuration.
+3. **Modification**: If the query does not comply, sql-data-guard can modify the query to ensure it meets the restrictions.
+4. **Output**: It returns whether the query is allowed to run or not, and if necessary, the modified query.
+
+sql-data-guard is designed to be easy to integrate into your application. It provides a simple API that you can call to verify and modify SQL queries before they are executed. You can integrate it using REST API or directly in your application code. 
+
+## Example
+
+Below you can find a Python snippet with allowed data access configuration, and usage of sql-data-guard. sql-data-guard finds a restricted column and an “always-true” possible injection and removes them both. It also adds a missing data restriction:
+
+```python
+from sql_data_guard import verify_sql
+
+config = {
+    "tables": [
+        {
+            "name": "orders",
+            "columns": ["id", "product_name", "account_id"],
+            "restrictions": [{"column": "account_id", "value": 123}]
+        }
+    ] 
+}
+
+query = "SELECT id, name FROM orders WHERE 1 = 1"
+result = verify_sql(query, config)
+print(result)
+```
+Output:
+```json
+{
+    "allowed": false,
+    "errors": ["Column name not allowed. Column removed from SELECT clause", 
+      "Always-True expression is not allowed", "Missing restriction for table: orders column: account_id value: 123"],
+    "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"
+}
+```
+Here is a table with more examples of SQL queries and their corresponding JSON outputs:
+
+| SQL Query                                               | JSON Output                                                                                                                                                                         |
+|---------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| SELECT id, product_name FROM orders WHERE account_id = 123 | { "allowed": true, "errors": [], "fixed": null }                                                                                                                                    |
+| SELECT id FROM orders WHERE account_id = 456            | { "allowed": false, "errors": ["Missing restriction for table: orders column: account_id value: 123"], "fixed": "SELECT id FROM orders WHERE account_id = 456 AND account_id = 123" } |
+| SELECT id, col FROM orders WHERE account_id = 123      | { "allowed": false, "errors": ["Column col is not allowed. Column removed from SELECT clause"], "fixed": "SELECT id FROM orders WHERE account_id = 123" } ```               |
+| SELECT id FROM orders WHERE account_id = 123 OR 1 = 1 | { "allowed": false, "errors": ["Always-True expression is not allowed"], "fixed": "SELECT id FROM orders WHERE account_id = 123" }                                                  |
+|SELECT * FROM orders WHERE account_id = 123| {"allowed": false, "errors": ["SELECT * is not allowed"], "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"}                                |
+```
+
+
+This table provides a variety of SQL queries and their corresponding JSON outputs, demonstrating how `sql-data-guard` handles different scenarios.
+
+## Installation
+To install sql-data-guard, use pip:
+
+```bash
+pip install sql-data-guard
+```
+
+## Docker Repository
+
+sql-data-guard is also available as a Docker image, which can be used to run the application in a containerized environment. This is particularly useful for deployment in cloud environments or for maintaining consistency across different development setups.
+
+### Running the Docker Container
+
+To run the sql-data-guard Docker container, use the following command:
+
+```bash
+docker run -d --name sql-data-guard -p 5000:5000 ghcr.io/thalesgroup/sql-data-guard
+
+### Calling the Docker Container Using REST API
+
+Once the `sql-data-guard` Docker container is running, you can interact with it using its REST API. Below is an example of how to verify an SQL query using `curl`:
+
+```bash
+curl -X POST http://localhost:5000/verify-sql \
+     -H "Content-Type: application/json" \
+     -d '{
+           "sql": "SELECT * FROM orders WHERE account_id = 123",
+           "config": {
+             "tables": [
+               {
+                 "table_name": "orders",
+                 "columns": ["id", "product_name", "account_id"],
+                 "restrictions": [{"column": "account_id", "value": 123}]
+               }             
+            ]
+           }
+         }'
+```
+
+## Contributing
+We welcome contributions! Please see our [CONTRIBUTING.md](CONTRIBUTING.md) for more details.
+
+## License
+This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.

sql_data_guard-0.0.40/pyproject.toml

@@ -0,0 +1,30 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools]
+include-package-data = false
+package-dir = {"" = "src"}
+[tool.pip]
+extra-index-url = ["https://pypi.org/simple"]
+[project]
+name = "sql-data-guard"
+version = "0.0.40"
+dependencies = [
+    "sqlglot"
+]
+authors = [
+  { name="Imperva - Threat Reseach Infra", email="ww.dis.imperva.threat-research-infra@thalesgroup.com" },
+]
+description = "Safety Layer for LLM Database Interactions"
+readme = "README.md"
+requires-python = ">=3.8"
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Operating System :: OS Independent",
+]
+license = {file = "LICENSE.md"}
+
+[project.urls]
+Homepage = "https://github.com/ThalesGroup/sql-data-guard"
+Issues = "https://github.com/ThalesGroup/sql-data-guard/issues"

sql_data_guard-0.0.40/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

sql_data_guard-0.0.40/src/sql_data_guard/__init__.py

@@ -0,0 +1 @@
+from .sql_data_guard import verify_sql

sql_data_guard-0.0.40/src/sql_data_guard/rest/__init__.py

@@ -0,0 +1 @@
+from sql_data_guard.rest.sql_data_guard_rest import app

sql_data_guard-0.0.40/src/sql_data_guard/rest/sql_data_guard_rest.py

@@ -0,0 +1,39 @@
+import logging
+import os
+from logging.config import fileConfig
+
+from flask import Flask, jsonify, request
+
+from sql_data_guard import verify_sql
+
+app = Flask(__name__)
+
+
+@app.route("/verify-sql", methods=["POST"])
+def _verify_sql():
+    if not request.is_json:
+        return jsonify({"error": "Request must be JSON"}), 400
+    data = request.get_json()
+    if "sql" not in data:
+        return jsonify({"error": "Missing 'sql' in request"}), 400
+    sql = data["sql"]
+    if "config" not in data:
+        return jsonify({"error": "Missing 'config' in request"}), 400
+    config = data["config"]
+    dialect = data.get("dialect")
+    result = verify_sql(sql, config, dialect)
+    result["errors"] = list(result["errors"])
+    return jsonify(result)
+
+
+def _init_logging():
+    fileConfig(os.path.join(os.path.dirname(os.path.abspath(__file__)), "logging.conf"))
+    logging.info("Logging initialized")
+
+
+if __name__ == "__main__":
+    _init_logging()
+    logging.getLogger("werkzeug").setLevel("WARNING")
+    port = os.environ.get("APP_PORT", 5000)
+    logging.info(f"Going to start the app. Port: {port}")
+    app.run(host="0.0.0.0", port=port)

sql_data_guard-0.0.40/src/sql_data_guard/restriction_validation.py

@@ -0,0 +1,82 @@
+class UnsupportedRestrictionError(Exception):
+    pass
+
+
+def validate_restrictions(config: dict):
+    """
+    Validates the restrictions in the configuration to ensure only supported operations are used.
+
+    Args:
+        config (dict): The configuration containing the restrictions to validate.
+
+    Raises:
+        UnsupportedRestrictionError: If an unsupported restriction operation is found.
+        ValueError: If there are no tables in the configuration.
+    """
+    supported_operations = [
+        "=",
+        ">",
+        "<",
+        ">=",
+        "<=",
+        "!=",
+        "BETWEEN",
+        "IN",
+    ]  # Allowed operations
+    # Ensure 'tables' exists in config and is not empty
+    tables = config.get("tables", [])
+    # Check if tables are empty
+    if not tables:
+        raise ValueError("Configuration must contain at least one table.")
+
+    for table in tables:
+        # Ensure that 'table_name' exists in each table
+        if "table_name" not in table:
+            raise ValueError("Each table must have a 'table_name' key.")
+            # Ensure that 'columns' exists and is not empty in each table
+        if "columns" not in table or not table["columns"]:
+            raise ValueError(
+                "Each table must have a 'columns' key with valid column definitions."
+            )
+
+        restrictions = table.get("restrictions", [])
+        if not restrictions:
+            continue  # Skip if no restrictions are provided
+
+        for restriction in restrictions:
+            operation = restriction.get("operation")
+            if operation == "BETWEEN":
+                values = restriction.get("values")
+                if not (
+                    isinstance(values, list)
+                    and len(values) == 2
+                    and all(isinstance(v, (int, float)) for v in values)
+                    and values[0] < values[1]
+                ):
+                    raise ValueError(
+                        f"Invalid 'BETWEEN' format. Expected list of two numeric values where min < max. Received: {values}"
+                    )
+
+            elif operation == "IN":
+                values = restriction.get("values")
+                if not (
+                    isinstance(values, list)
+                    and len(values) == 2
+                    and all(isinstance(v, (int, float)) for v in values)
+                ):
+                    raise ValueError(
+                        f"Invalid 'IN' format. Expected list of two numeric values. Received: {values}"
+                    )
+
+            elif operation == ">=":
+                # You may want to ensure the value provided is numeric for >=
+                value = restriction.get("value")
+                if not isinstance(value, (int, float)):
+                    raise ValueError(
+                        f"Invalid restriction value type for column '{restriction['column']}' in table '{table['table_name']}'. Expected a numeric value."
+                    )
+
+            elif operation and operation.lower() not in supported_operations:
+                raise UnsupportedRestrictionError(
+                    f"Invalid restriction: 'operation={operation}' is not supported."
+                )

sql_data_guard-0.0.40/src/sql_data_guard/restriction_verification.py

@@ -0,0 +1,146 @@
+from typing import List
+
+import sqlglot
+import sqlglot.expressions as expr
+
+from sql_data_guard.verification_context import VerificationContext
+from sql_data_guard.verification_utils import split_to_expressions
+
+
+def verify_restrictions(
+    select_statement: expr.Query,
+    context: VerificationContext,
+    from_tables: List[expr.Table],
+):
+    where_clause = select_statement.find(expr.Where)
+    if where_clause is None:
+        where_clause = select_statement.find(expr.Where)
+        and_exps = []
+    else:
+        and_exps = list(split_to_expressions(where_clause.this, expr.And))
+    for c_t in context.config["tables"]:
+        for from_t in [t for t in from_tables if t.name == c_t["table_name"]]:
+            for idx, r in enumerate(c_t.get("restrictions", [])):
+                found = False
+                for sub_exp in and_exps:
+                    if _verify_restriction(r, from_t, sub_exp):
+                        found = True
+                        break
+                if not found:
+                    if from_t.alias:
+                        t_prefix = f"{from_t.alias}."
+                    elif len([t for t in from_tables if t.name == from_t.name]) > 1:
+                        t_prefix = f"{from_t.name}."
+                    else:
+                        t_prefix = ""
+
+                    context.add_error(
+                        f"Missing restriction for table: {c_t['table_name']} column: {t_prefix}{r['column']} value: {r.get('values', r.get('value'))}",
+                        True,
+                        0.5,
+                    )
+                    new_condition = _create_new_condition(context, r, t_prefix)
+                    if where_clause is None:
+                        where_clause = expr.Where(this=new_condition)
+                        select_statement.set("where", where_clause)
+                    else:
+                        where_clause = where_clause.replace(
+                            expr.Where(
+                                this=expr.And(
+                                    this=expr.paren(where_clause.this),
+                                    expression=new_condition,
+                                )
+                            )
+                        )
+
+
+def _create_new_condition(
+    context: VerificationContext, restriction: dict, table_prefix: str
+) -> expr.Expression:
+    """
+    Used to create a restriction condition for a given restriction.
+
+    Args:
+        context: verification context
+        restriction: restriction to create condition for
+        table_prefix: table prefix to use in the condition
+
+    Returns: condition expression
+
+    """
+    if restriction.get("operation") == "BETWEEN":
+        operator = "BETWEEN"
+        operand = f"{_format_value(restriction["values"][0])} AND {_format_value(restriction["values"][1])}"
+    elif restriction.get("operation") == "IN":
+        operator = "IN"
+        values = restriction.get("values", [restriction.get("value")])
+        operand = f"({', '.join(map(str, values))})"
+    else:
+        operator = "="
+        operand = (
+            _format_value(restriction["value"])
+            if "value" in restriction
+            else str(restriction["values"])[1:-1]
+        )
+    new_condition = sqlglot.parse_one(
+        f"{table_prefix}{restriction['column']} {operator} {operand}",
+        dialect=context.dialect,
+    )
+    return new_condition
+
+
+def _format_value(value):
+    if isinstance(value, str):
+        return f"'{value}'"
+    else:
+        return value
+
+
+def _verify_restriction(
+    restriction: dict, from_table: expr.Table, exp: expr.Expression
+) -> bool:
+    """
+    Verifies if a given restriction is satisfied within an SQL expression.
+
+    Args:
+        restriction (dict): The restriction to verify, containing 'column' and 'value' keys.
+        from_table (Table): The table reference to check the restriction against.
+        exp (list): The SQL expression to check against the restriction.
+
+    Returns:
+        bool: True if the restriction is satisfied, False otherwise.
+    """
+    if isinstance(exp, expr.Not):
+        return False
+    if isinstance(exp, expr.Paren):
+        return _verify_restriction(restriction, from_table, exp.this)
+    if not isinstance(exp.this, expr.Column):
+        return False
+    if not exp.this.name == restriction["column"]:
+        return False
+    if exp.this.table and from_table.alias and exp.this.table != from_table.alias:
+        return False
+    if exp.this.table and not from_table.alias and exp.this.table != from_table.name:
+        return False
+    if isinstance(exp, expr.EQ) and isinstance(exp.right, expr.Condition):
+        if isinstance(exp.right, expr.Boolean):
+            return exp.right.this == restriction["value"]
+        else:
+            values = _get_restriction_values(restriction)
+            return exp.right.this in values
+    if isinstance(exp, expr.Between):
+        sql_values = [v.this for v in exp.expressions]
+        values = _get_restriction_values(restriction)
+        return any(v in values for v in sql_values)
+    if isinstance(exp, expr.In):
+        values = [v.this for v in exp.expressions]
+        return False
+    return False
+
+
+def _get_restriction_values(restriction: dict) -> List[str]:
+    if "values" in restriction:
+        values = [str(v) for v in restriction["values"]]
+    else:
+        values = [str(restriction["value"])]
+    return values