Context
SQLite backend (mas-sqlite crate, currently dead code per F2). Per docs/audits/sqlite.md F3. Filed pre-emptively because the surface exists in registered commands.
Problem
src-tauri/crates/mas-sqlite/src/connection.rs takes any file path string. Unlike MySQL (which has a connection profile with credentials in keyring), SQLite has no scope check. A UI caller could pass /etc/passwd or ~/.ssh/id_rsa and the open succeeds — rusqlite returns an empty DB for non-SQLite files. If/when the UI ships per F1, an attacker who controls the path input (e.g. drag-drop, crafted URL) can probe filesystem.
Files
- src-tauri/crates/mas-sqlite/src/connection.rs
- src-tauri/src/commands/sqlite.rs:7 (sqlite_open)
Expected
sqlite_open validates the path: rejects non-SQLite files via PRAGMA quick_check, caps max file size at 256 MB, rejects paths with .. segments.
Proposed fix
M: in connection.rs::open(), (a) call conn.execute(PRAGMA quick_check) after open, propagate error as Err; (b) std::fs::metadata size check with 256 MB cap; (c) reject .. segments and paths outside /home/elliot + /tmp.
Acceptance
sqlite_open(/etc/passwd) returns Err. sqlite_open(/tmp/empty.db) against 0-byte file returns Err. Integration test covers each reject path.
Needs human verify
no (verifiable offline)
Context
SQLite backend (mas-sqlite crate, currently dead code per F2). Per docs/audits/sqlite.md F3. Filed pre-emptively because the surface exists in registered commands.
Problem
src-tauri/crates/mas-sqlite/src/connection.rs takes any file path string. Unlike MySQL (which has a connection profile with credentials in keyring), SQLite has no scope check. A UI caller could pass /etc/passwd or ~/.ssh/id_rsa and the open succeeds — rusqlite returns an empty DB for non-SQLite files. If/when the UI ships per F1, an attacker who controls the path input (e.g. drag-drop, crafted URL) can probe filesystem.
Files
Expected
sqlite_open validates the path: rejects non-SQLite files via PRAGMA quick_check, caps max file size at 256 MB, rejects paths with .. segments.
Proposed fix
M: in connection.rs::open(), (a) call conn.execute(PRAGMA quick_check) after open, propagate error as Err; (b) std::fs::metadata size check with 256 MB cap; (c) reject .. segments and paths outside /home/elliot + /tmp.
Acceptance
sqlite_open(/etc/passwd) returns Err. sqlite_open(/tmp/empty.db) against 0-byte file returns Err. Integration test covers each reject path.
Needs human verify
no (verifiable offline)