sql-data-guard 0.0.51__tar.gz → 0.1.3__tar.gz

{sql_data_guard-0.0.51/src/sql_data_guard.egg-info → sql_data_guard-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql-data-guard
-Version: 0.0.51
+Version: 0.1.3
 Summary: Safety Layer for LLM Database Interactions
 Author-email: Imperva - Threat Reseach Infra <ww.dis.imperva.threat-research-infra@thalesgroup.com>
 License: MIT License
@@ -26,7 +26,7 @@ Dynamic: license-file
 # sql-data-guard: Safety Layer for LLM Database Interactions
 
 <div style="text-align: center;">
-    <img alt="SQL Data Guard logo" src="https://github.com/ThalesGroup/sql-data-guard/blob/main/sql-data-guard-logo.png" width="300"/>
+    <img alt="SQL Data Guard logo" src="https://raw.githubusercontent.com/ThalesGroup/sql-data-guard/main/sql-data-guard-logo.png" width="300"/>
 </div>
 
 SQL is the go-to language for performing queries on databases, and for a good reason - it’s well known, easy to use and pretty simple. However, it seems that it’s as easy to use as it is to exploit, and SQL injection is still one of the most targeted vulnerabilities - especially nowadays with the proliferation of “natural language queries” harnessing Large Language Models (LLMs) power to generate and run SQL queries.
@@ -93,6 +93,9 @@ Output:
     "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"
 }
 ```
+For more details on restriction rules and validation, see the [manual.](docs/manual.md)
+
+
 Here is a table with more examples of SQL queries and their corresponding JSON outputs:
 
 | SQL Query                                               | JSON Output                                                                                                                                                                         |
@@ -102,8 +105,6 @@ Here is a table with more examples of SQL queries and their corresponding JSON o
 | SELECT id, col FROM orders WHERE account_id = 123      | { "allowed": false, "errors": ["Column col is not allowed. Column removed from SELECT clause"], "fixed": "SELECT id FROM orders WHERE account_id = 123" } ```               |
 | SELECT id FROM orders WHERE account_id = 123 OR 1 = 1 | { "allowed": false, "errors": ["Always-True expression is not allowed"], "fixed": "SELECT id FROM orders WHERE account_id = 123" }                                                  |
 |SELECT * FROM orders WHERE account_id = 123| {"allowed": false, "errors": ["SELECT * is not allowed"], "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"}                                |
-```
-
 
 This table provides a variety of SQL queries and their corresponding JSON outputs, demonstrating how `sql-data-guard` handles different scenarios.
 
@@ -124,6 +125,7 @@ To run the sql-data-guard Docker container, use the following command:
 
 ```bash
 docker run -d --name sql-data-guard -p 5000:5000 ghcr.io/thalesgroup/sql-data-guard
+```
 
 ### Calling the Docker Container Using REST API
 
@@ -147,7 +149,7 @@ curl -X POST http://localhost:5000/verify-sql \
 ```
 
 ## Contributing
-We welcome contributions! Please see our [CONTRIBUTING.md](CONTRIBUTING.md) for more details.
+We welcome contributions! Please see our [CONTRIBUTING.md](https://raw.githubusercontent.com/ThalesGroup/sql-data-guard/main/CONTRIBUTING.md) for more details.
 
 ## License
-This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.
+This project is licensed under the MIT License. See the [LICENSE.md](https://raw.githubusercontent.com/ThalesGroup/sql-data-guard/main/LICENSE.md) file for details.

{sql_data_guard-0.0.51 → sql_data_guard-0.1.3}/README.md

@@ -2,7 +2,7 @@
 # sql-data-guard: Safety Layer for LLM Database Interactions
 
 <div style="text-align: center;">
-    <img alt="SQL Data Guard logo" src="https://github.com/ThalesGroup/sql-data-guard/blob/main/sql-data-guard-logo.png" width="300"/>
+    <img alt="SQL Data Guard logo" src="https://raw.githubusercontent.com/ThalesGroup/sql-data-guard/main/sql-data-guard-logo.png" width="300"/>
 </div>
 
 SQL is the go-to language for performing queries on databases, and for a good reason - it’s well known, easy to use and pretty simple. However, it seems that it’s as easy to use as it is to exploit, and SQL injection is still one of the most targeted vulnerabilities - especially nowadays with the proliferation of “natural language queries” harnessing Large Language Models (LLMs) power to generate and run SQL queries.
@@ -69,6 +69,9 @@ Output:
     "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"
 }
 ```
+For more details on restriction rules and validation, see the [manual.](docs/manual.md)
+
+
 Here is a table with more examples of SQL queries and their corresponding JSON outputs:
 
 | SQL Query                                               | JSON Output                                                                                                                                                                         |
@@ -78,8 +81,6 @@ Here is a table with more examples of SQL queries and their corresponding JSON o
 | SELECT id, col FROM orders WHERE account_id = 123      | { "allowed": false, "errors": ["Column col is not allowed. Column removed from SELECT clause"], "fixed": "SELECT id FROM orders WHERE account_id = 123" } ```               |
 | SELECT id FROM orders WHERE account_id = 123 OR 1 = 1 | { "allowed": false, "errors": ["Always-True expression is not allowed"], "fixed": "SELECT id FROM orders WHERE account_id = 123" }                                                  |
 |SELECT * FROM orders WHERE account_id = 123| {"allowed": false, "errors": ["SELECT * is not allowed"], "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"}                                |
-```
-
 
 This table provides a variety of SQL queries and their corresponding JSON outputs, demonstrating how `sql-data-guard` handles different scenarios.
 
@@ -100,6 +101,7 @@ To run the sql-data-guard Docker container, use the following command:
 
 ```bash
 docker run -d --name sql-data-guard -p 5000:5000 ghcr.io/thalesgroup/sql-data-guard
+```
 
 ### Calling the Docker Container Using REST API
 
@@ -123,7 +125,7 @@ curl -X POST http://localhost:5000/verify-sql \
 ```
 
 ## Contributing
-We welcome contributions! Please see our [CONTRIBUTING.md](CONTRIBUTING.md) for more details.
+We welcome contributions! Please see our [CONTRIBUTING.md](https://raw.githubusercontent.com/ThalesGroup/sql-data-guard/main/CONTRIBUTING.md) for more details.
 
 ## License
-This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.
+This project is licensed under the MIT License. See the [LICENSE.md](https://raw.githubusercontent.com/ThalesGroup/sql-data-guard/main/LICENSE.md) file for details.

{sql_data_guard-0.0.51 → sql_data_guard-0.1.3}/pyproject.toml

@@ -9,7 +9,7 @@ package-dir = {"" = "src"}
 extra-index-url = ["https://pypi.org/simple"]
 [project]
 name = "sql-data-guard"
-version = "0.0.51"
+version = "0.1.3"
 dependencies = [
     "sqlglot"
 ]

{sql_data_guard-0.0.51 → sql_data_guard-0.1.3}/src/sql_data_guard/restriction_validation.py

@@ -19,7 +19,6 @@ def validate_restrictions(config: dict):
         "<",
         ">=",
         "<=",
-        "!=",
         "BETWEEN",
         "IN",
     ]  # Allowed operations

{sql_data_guard-0.0.51 → sql_data_guard-0.1.3}/src/sql_data_guard/restriction_verification.py

@@ -70,7 +70,7 @@ def _create_new_condition(
     """
     if restriction.get("operation") == "BETWEEN":
         operator = "BETWEEN"
-        operand = f"{_format_value(restriction["values"][0])} AND {_format_value(restriction["values"][1])}"
+        operand = f"{_format_value(restriction['values'][0])} AND {_format_value(restriction['values'][1])}"
     elif restriction.get("operation") == "IN":
         operator = "IN"
         values = restriction.get("values", [restriction.get("value")])

{sql_data_guard-0.0.51 → sql_data_guard-0.1.3}/src/sql_data_guard/sql_data_guard.py

@@ -124,6 +124,10 @@ def _has_static_expression(context: VerificationContext, exp: expr.Expression) -
 
 
 def _verify_query_statement(query_statement: expr.Query, context: VerificationContext):
+    for select in query_statement.selects:
+        for sub in select.find_all(expr.Subquery):
+            _add_table_alias(sub, context)
+            _verify_query_statement(sub.this, context)
     if isinstance(query_statement, expr.Union):
         _verify_query_statement(query_statement.left, context)
         _verify_query_statement(query_statement.right, context)
@@ -131,6 +135,10 @@ def _verify_query_statement(query_statement: expr.Query, context: VerificationCo
     for cte in query_statement.ctes:
         _add_table_alias(cte, context)
         _verify_query_statement(cte.this, context)
+    where_clause = query_statement.find(expr.Where)
+    if where_clause:
+        for sub in where_clause.find_all(expr.Subquery):
+            _verify_query_statement(sub.this, context)
     from_tables = _get_from_clause_tables(query_statement, context)
     for t in from_tables:
         found = False
@@ -247,8 +255,8 @@ def _get_from_clause_tables(
     """
     result = []
     from_clause = select_clause.find(expr.From)
-    join_clause = select_clause.find(expr.Join)
-    for clause in [from_clause, join_clause]:
+    join_clauses = select_clause.args.get("joins", [])
+    for clause in [from_clause] + join_clauses:
         if clause:
             for t in find_direct(clause, expr.Table):
                 if isinstance(t, expr.Table):
@@ -256,7 +264,7 @@ def _get_from_clause_tables(
             for l in find_direct(clause, expr.Subquery):
                 _add_table_alias(l, context)
                 _verify_query_statement(l.this, context)
-    if join_clause:
+    for join_clause in join_clauses:
         for l in find_direct(join_clause, expr.Lateral):
             _add_table_alias(l, context)
             _verify_query_statement(l.this.find(expr.Select), context)

{sql_data_guard-0.0.51 → sql_data_guard-0.1.3/src/sql_data_guard.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql-data-guard
-Version: 0.0.51
+Version: 0.1.3
 Summary: Safety Layer for LLM Database Interactions
 Author-email: Imperva - Threat Reseach Infra <ww.dis.imperva.threat-research-infra@thalesgroup.com>
 License: MIT License
@@ -26,7 +26,7 @@ Dynamic: license-file
 # sql-data-guard: Safety Layer for LLM Database Interactions
 
 <div style="text-align: center;">
-    <img alt="SQL Data Guard logo" src="https://github.com/ThalesGroup/sql-data-guard/blob/main/sql-data-guard-logo.png" width="300"/>
+    <img alt="SQL Data Guard logo" src="https://raw.githubusercontent.com/ThalesGroup/sql-data-guard/main/sql-data-guard-logo.png" width="300"/>
 </div>
 
 SQL is the go-to language for performing queries on databases, and for a good reason - it’s well known, easy to use and pretty simple. However, it seems that it’s as easy to use as it is to exploit, and SQL injection is still one of the most targeted vulnerabilities - especially nowadays with the proliferation of “natural language queries” harnessing Large Language Models (LLMs) power to generate and run SQL queries.
@@ -93,6 +93,9 @@ Output:
     "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"
 }
 ```
+For more details on restriction rules and validation, see the [manual.](docs/manual.md)
+
+
 Here is a table with more examples of SQL queries and their corresponding JSON outputs:
 
 | SQL Query                                               | JSON Output                                                                                                                                                                         |
@@ -102,8 +105,6 @@ Here is a table with more examples of SQL queries and their corresponding JSON o
 | SELECT id, col FROM orders WHERE account_id = 123      | { "allowed": false, "errors": ["Column col is not allowed. Column removed from SELECT clause"], "fixed": "SELECT id FROM orders WHERE account_id = 123" } ```               |
 | SELECT id FROM orders WHERE account_id = 123 OR 1 = 1 | { "allowed": false, "errors": ["Always-True expression is not allowed"], "fixed": "SELECT id FROM orders WHERE account_id = 123" }                                                  |
 |SELECT * FROM orders WHERE account_id = 123| {"allowed": false, "errors": ["SELECT * is not allowed"], "fixed": "SELECT id, product_name, account_id FROM orders WHERE account_id = 123"}                                |
-```
-
 
 This table provides a variety of SQL queries and their corresponding JSON outputs, demonstrating how `sql-data-guard` handles different scenarios.
 
@@ -124,6 +125,7 @@ To run the sql-data-guard Docker container, use the following command:
 
 ```bash
 docker run -d --name sql-data-guard -p 5000:5000 ghcr.io/thalesgroup/sql-data-guard
+```
 
 ### Calling the Docker Container Using REST API
 
@@ -147,7 +149,7 @@ curl -X POST http://localhost:5000/verify-sql \
 ```
 
 ## Contributing
-We welcome contributions! Please see our [CONTRIBUTING.md](CONTRIBUTING.md) for more details.
+We welcome contributions! Please see our [CONTRIBUTING.md](https://raw.githubusercontent.com/ThalesGroup/sql-data-guard/main/CONTRIBUTING.md) for more details.
 
 ## License
-This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.
+This project is licensed under the MIT License. See the [LICENSE.md](https://raw.githubusercontent.com/ThalesGroup/sql-data-guard/main/LICENSE.md) file for details.

{sql_data_guard-0.0.51 → sql_data_guard-0.1.3}/test/test_sql_guard_curr_unit.py

@@ -534,11 +534,19 @@ class TestSQLOrderDateBetweenRestrictions:
 
     def test_price_between_valid(self, cnn, config):
         verify_sql_test(
-            "SELECT prod_id, prod_name, price"
-            "FROM products WHERE price BETWEEN 80 AND 150",
+            "SELECT prod_id, prod_name, price FROM products WHERE price BETWEEN 80 AND 150",
             config,
             cnn=cnn,
-            data=[],
+            errors={
+                "Missing restriction for table: products column: price value: [80, 150]"
+            },
+            fix="SELECT prod_id, prod_name, price FROM products WHERE (price BETWEEN 80 AND "
+            "150) AND price BETWEEN 80 AND 150",
+            data=[
+                (1, "Product A", 120.0),
+                (2, "Product B", 80.0),
+                (3, "Product C", 150.0),
+            ],
         )
 
     def test_price_not_between_restriction(self, cnn, config):
@@ -572,17 +580,19 @@ class TestSQLOrderDateBetweenRestrictions:
 
     def test_left_join_products_with_orders(self, cnn, config):
         verify_sql_test(
-            "SELECT p.prod_name, o.order_id, COALESCE(o.quantity, 0) AS quantity "
-            "FROM products p "
-            "LEFT JOIN orders o ON prod_id = prod_id "
-            "WHERE p.price BETWEEN 80 AND 150",
+            """SELECT p.prod_name, o.order_id, COALESCE(o.quantity, 0) AS quantity 
+            FROM products p 
+            LEFT JOIN orders o ON p.prod_id = o.prod_id 
+            WHERE p.price BETWEEN 80 AND 150""",
             config,
             errors={
                 "Missing restriction for table: products column: p.price value: [80, 150]"
             },
-            fix="SELECT p.prod_name, o.order_id, COALESCE(o.quantity, 0) AS quantity FROM products AS p LEFT JOIN orders AS o ON prod_id = prod_id WHERE (p.price BETWEEN 80 AND 150) AND p.price BETWEEN 80 AND 150",
+            fix="SELECT p.prod_name, o.order_id, COALESCE(o.quantity, 0) AS quantity FROM "
+            "products AS p LEFT JOIN orders AS o ON p.prod_id = o.prod_id WHERE (p.price "
+            "BETWEEN 80 AND 150) AND p.price BETWEEN 80 AND 150",
             cnn=cnn,
-            data=[],
+            data=[("Product A", 1, 10), ("Product B", 2, 5), ("Product C", 3, 7)],
         )
 
     def test_select_products_below_price_restriction(self, cnn, config):

{sql_data_guard-0.0.51 → sql_data_guard-0.1.3}/test/test_sql_guard_unit.py

@@ -252,6 +252,7 @@ INSERT INTO orders (order_id, account_id, product_id) VALUES
         COUNT(o.order_id) AS order_count
     FROM orders o    
     JOIN products p ON o.product_id = p.product_id
+    WHERE o.account_id = 123
     GROUP BY o.account_id, p.product_name
 ),
 RankedProducts AS (
@@ -273,11 +274,16 @@ FROM OrderCounts oc
 JOIN RankedProducts rp ON oc.product_name = rp.product_name
 WHERE oc.account_id IN (
     -- Filter accounts with at least 2 orders
-    SELECT account_id FROM orders GROUP BY account_id HAVING COUNT(order_id) >= 2
+    SELECT account_id FROM orders
+    WHERE account_id = 123
+    GROUP BY account_id HAVING COUNT(order_id) >= 2
 )
 ORDER BY oc.account_id, rp.product_rank;"""
-        verify_sql_test_data(
-            sql, config, cnn, [(123, "Laptop", 1, 1), (123, "Smartphone", 1, 1)]
+        verify_sql_test(
+            sql,
+            config,
+            cnn=cnn,
+            data=[(123, "Laptop", 1, 1), (123, "Smartphone", 1, 1)],
         )
 
 

{sql_data_guard-0.0.51 → sql_data_guard-0.1.3}/test/test_sql_guard_updates_unit.py

@@ -647,7 +647,9 @@ class TestMultipleRestriction:
                         "prod_name",
                         "category",
                     ],  # category stored as JSON
-                    "restrictions": [{"column": "id", "values": [324, 224]}],
+                    "restrictions": [
+                        {"column": "id", "values": [324, 224], "operation": "IN"}
+                    ],
                 },
                 {
                     "table_name": "customers",
@@ -704,7 +706,7 @@ class TestMultipleRestriction:
             },
             fix="SELECT id FROM products1 WHERE (id IN (324, 224)) AND id IN (324, 224)",
             cnn=cnn,
-            data=[],
+            data=[["324"]],
         )
 
     def test_with_in_operator2(self, config, cnn):
@@ -716,7 +718,7 @@ class TestMultipleRestriction:
             },
             fix="SELECT id FROM products1 WHERE (id IN (324, 233)) AND id IN (324, 224)",
             cnn=cnn,
-            data=[],
+            data=[["324"]],
         )
 
     def test_in_operator_with_or(self, config, cnn):
@@ -728,7 +730,7 @@ class TestMultipleRestriction:
                 "Missing restriction for table: products1 column: id value: [324, 224]"
             },
             fix="""SELECT id FROM products1 WHERE ((id IN (324, 224) OR prod_name = 'prod3')) AND id IN (324, 224)""",
-            data=[],
+            data=[["324"]],
         )
 
     def test_not_in_operator(self, config, cnn):
@@ -745,13 +747,13 @@ class TestMultipleRestriction:
 
     def test_in_operator_with_numeric_values(self, config, cnn):
         verify_sql_test(
-            """SELECT id FROM products1 WHERE (id IN (324, 224) AND category IN ('electronics', 'furniture'))""",
+            """SELECT id FROM products2 WHERE (id IN (324, 224) AND category IN ('electronics', 'furniture'))""",
             config,
             cnn=cnn,
             errors={
-                "Missing restriction for table: products1 column: id value: [324, 224]"
+                "Missing restriction for table: products2 column: id value: [324, 224]"
             },
-            fix="SELECT id FROM products1 WHERE ((id IN (324, 224) AND category IN "
+            fix="SELECT id FROM products2 WHERE ((id IN (324, 224) AND category IN "
             "('electronics', 'furniture'))) AND id IN (324, 224)",
             data=[],
         )