Repository navigation
Harden database-explorer extension against write bypass and CSRF - #181
Open
RamyaR1010 wants to merge 1 commit into
Open
RamyaR1010 wants to merge 1 commit into
RamyaR1010 wants to merge 1 commit into
Conversation
- Run queries with PRAGMA query_only and reject DML/DDL keywords in WITH queries - Require Host/Origin checks, JSON content type, and a per-instance token on the local server Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The SQL blacklist incorrectly blocks SQLite’s read-only replace() function, causing legitimate SELECT queries to fail through both /api/query and the canvas action.
1 open issue
What changed in this PR
Hardens the database-explorer Copilot extension against SQL write bypasses and cross-site requests to its local HTTP server.
Changes:
- Enables SQLite query-only mode and adds SQL keyword validation.
- Validates Host and Origin headers, requires an API token, and checks query request content types.
- Updates the embedded UI to send the per-instance token.
| File | Description |
|---|---|
.github/extensions/database-explorer/extension.mjs |
Adds database read-only safeguards and local HTTP request protections. |
Review effort: Balanced
|
|
||
| // Blocks data-modifying statements hidden behind WITH; the read-only connection is the primary defense. | ||
| const withoutLiterals = statement.replace(/'(?:[^']|'')*'|"(?:[^"]|"")*"|`(?:[^`]|``)*`/g, " "); | ||
| if (/\b(INSERT|UPDATE|DELETE|REPLACE|DROP|ALTER|CREATE|ATTACH|DETACH|PRAGMA|VACUUM|REINDEX)\b/i.test(withoutLiterals)) { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Hardens the
database-explorerCopilot extension. Its read-only guard only checked that a query started withSELECT/WITH, soWITH x AS (SELECT 1) DELETE FROM gamespassed and ran on a read-write connection. Its local HTTP server also had no Host/Origin/CSRF protection, so a web page could reach it.Related Issue
N/A (found in a security audit)
Type of Change
Changes Made
PRAGMA query_only = ONHostandOrigin, requireContent-Type: application/jsonon/api/query, and require a per-instance random token (X-Explorer-Token) on API routesTesting
node --checkon the extension passes.npm run lint,npm run test:unit,npm run test:e2e(dependencies not installed in this worktree; the change only touches.github/extensions, outside the app and its test suites).Checklist