fix: percent-encode datachecks sqlite mode=ro URI + pin C5 reconcile read-only for '?'-named files#22
Conversation
…le read-only The sealed C5 reconcile path (c5_data.py) already percent-encodes the sqlite file: URI so an in-repo file whose NAME contains a '?' cannot inject URI params that override mode=ro. Apply the same encoding to the one remaining raw f-string at datachecks.py:242 (the dev-time `suggest-data-checks` helper) for consistency. Add a regression test through the C5 reconcile path with an in-repo sqlite file named `q?.db`: - it opens the RIGHT file read-only (4 rows == the csv -> PASS); reverting the encoding truncates the path at '?' and this becomes ERROR (fix-discriminating); - a CREATE TABLE through reconcile is rejected (ERROR) and the DB is left unmodified (read-only enforced; the '?' cannot inject mode=rwc). Surgical: no C5 grammar, authorizer, or deny-exec/gating change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 36 minutes and 29 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2 participants
What
The sealed C5 reconcile path (
c5_data.py) already percent-encodes its sqlitefile:URI (shipped in v1.2.0). This applies the same encoding to the one remaining raw f-string —datachecks.py:242, the dev-timesuggest-data-checkshelper — and adds a regression test that pins the read-only contract through the C5 reconcile path.Why
An in-repo file whose name contains a URI query (e.g.
a?mode=rwc&x=.db) injects params intofile:{path}?mode=ro, so SQLite honors the firstmode=rwcand the read-only intent is bypassed. Not a repo escape (the path is containment-checked first, and the statement authorizer still blocks write SQL) — defense-in-depth hardening only.Test (
tests/test_c5.py)..._opens_the_right_file: a reconcile SELECT against an in-repoq?.dbreturns the correct count (fix-discriminating — without the encoding the path truncates at?and this ERRORs)...._stays_read_only: aCREATE TABLEthrough reconcile againstq?.dbis rejected and the DB is left unmodified.Verified at the URI level: raw
file:.../a?mode=rwc&z=.db?mode=ro→ WRITABLE (mode=ro bypassed);quote()-encoded → read-only.Scope
Surgical — no C5 grammar, authorizer, or deny-exec/gating change.
c5_data.pyunchanged (already fixed).