You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This pull request modifies the Python code to use a raw string for the PostgreSQL connection string.
💭 Motivation and context
If the PostgreSQL password, for example, contains a literal backslash (\) character then we do not want it to be interpreted as the first character in a Python string escape sequence.
It is highly unlikely that anyone would choose a host name, database name, username, or password that genuinely contains special characters like \n, \t, etc.; therefore, it should be safe to treat all backslashes in the PostgreSQL connection string as literal backslashes.
🧪 Testing
All automated tests pass.
✅ Pre-approval checklist
This PR has an informative and human-readable title.
Changes are limited to a single goal - eschew scope creep!
All relevant type-of-change labels have been added.
The password, in particular, may contain backslash literals. This
will ensure that such backslashes are not treated as the first
character in a Python escape sequence.
jsf9k
added
bug
This issue or pull request addresses broken functionality
version bump
This issue or pull request increments the version number
python
Pull requests that update Python code
labels
Feb 28, 2025
Hi Shane @jsf9k , just one comment, in the src/guacscanner/guacscanner.py file the instances where cursor.execute(ENTITY_COUNT_QUERY, (entity_name, entity_type)) is used these are examples of string concatenation which is a possible vulnerability for SQL injection. What's your thoughts?
Hi Shane @jsf9k , just one comment, in the src/guacscanner/guacscanner.py file the instances where cursor.execute(ENTITY_COUNT_QUERY, (entity_name, entity_type)) is used these are examples of string concatenation which is a possible vulnerability for SQL injection. What's your thoughts?
In this project I think it's OK. The values being concatenated do not originate from users but from the AWS API, and the latter is a trusted source.
Makes sense, but we should still test that this actually works as intended.
The only real way to test is to add a backslash to the PostgreSQL password in, say, our dev-a COOL environment. I will get @dav3r's assistance with that when we finish up the current cisagov/skeleton-packer Lineage wave.
bugThis issue or pull request addresses broken functionalitypythonPull requests that update Python codeversion bumpThis issue or pull request increments the version number
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
jsf9k
added
bug
🗣 Description
This pull request modifies the Python code to use a raw string for the PostgreSQL connection string.
💭 Motivation and context
If the PostgreSQL password, for example, contains a literal backslash (
\) character then we do not want it to be interpreted as the first character in a Python string escape sequence.It is highly unlikely that anyone would choose a host name, database name, username, or password that genuinely contains special characters like
\n,\t, etc.; therefore, it should be safe to treat all backslashes in the PostgreSQL connection string as literal backslashes.🧪 Testing
All automated tests pass.
✅ Pre-approval checklist
✅ Pre-merge checklist
✅ Post-merge checklist