SNOW-3417304: escape single quotes in SHOW ... LIKE patterns#2985
Open
sfc-gh-olorek wants to merge 1 commit into
Open
SNOW-3417304: escape single quotes in SHOW ... LIKE patterns#2985sfc-gh-olorek wants to merge 1 commit into
sfc-gh-olorek wants to merge 1 commit into
Conversation
`ObjectManager.show` and `ImageRepositoryManager.list_images` build
`SHOW ... LIKE '{pattern}'` by f-string interpolation without escaping
the LIKE argument. A single quote in `--like` terminates the literal
early and because `execute_stream` splits the resulting SQL on
semicolons, trailing content is executed as additional statements in
the caller's own session.
Escape single quotes at both sinks by doubling them
(`'` -> `''`), which is the canonical SQL literal escape and preserves
legitimate patterns containing `%` / `_`. Exploit requires access to
the developer's CLI invocation, so impact is self-injection only, but
the fix is trivial.
Added regression tests covering the classic
`foo'; drop table users; --` payload at both sites.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pre-review checklist
Changes description
ObjectManager.show(src/snowflake/cli/_plugins/object/manager.py:61) andImageRepositoryManager.list_images(
src/snowflake/cli/_plugins/spcs/image_repository/manager.py:88) both buildSHOW ... LIKE '{pattern}'by f-string interpolation of the raw--likeargument. A single quote in the pattern terminates the SQL string literal
early; because
execute_streamsplits the resulting statement on semicolons,anything after the injected quote is run as its own statement in the caller's
own session.
Fix: double single quotes at the SQL construction site (
'→''), which isthe canonical way to escape a single quote inside a Snowflake string literal
and leaves legitimate
%/_metacharacters untouched.The exploit path requires access to the developer's own CLI invocation
(
--likeis not read from a project file or external source), so there is nosupply-chain vector and no privilege escalation — but a user who pastes an
attacker-supplied
--likevalue will execute arbitrary SQL with their ownrole. The fix is also precondition for any future feature that plumbs
--likefrom a less-trusted source (e.g. a template or config).Ticket: SNOW-3417304