33 lines
2.1 KiB
Markdown
33 lines
2.1 KiB
Markdown
# Shared database confidentiality dependency
|
|
|
|
Private-file input was insufficient by itself: an actual previous-revision CLI
|
|
add with `database.LOG_SQL=true` exposed the synthetic client secret in XORM
|
|
output. `evidence/sql-leak-before.log` retains the failed leak assertion without
|
|
printing the captured value. This is an implementation finding, not an accepted
|
|
runtime trial. Disabling raw SQL output alone also leaves the existing slow,
|
|
error and runtime trace hooks, which include query arguments/driver errors.
|
|
|
|
The common dependency is exactly the separately prepared Apps operation-backend
|
|
implementation, not a competing helper. Its API is `db.WithSensitiveSQL(ctx)`.
|
|
The actual SQL/slow/error/trace hooks redact statement/arguments/driver errors
|
|
when that context marker is present. The dependency's actual hook tests retain
|
|
positive unredacted controls, including a real runtime trace buffer. Custom
|
|
DB/server audit outside this process remains an owner custody concern.
|
|
|
|
Apply `shared-db-confidentiality.patch` exactly once when composing both source
|
|
candidates. Its three postimages must match the operation-backend source:
|
|
|
|
| Path | SHA-256 |
|
|
| --- | --- |
|
|
| `models/db/engine.go` | `43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96` |
|
|
| `models/db/sensitive_sql.go` | `8d4e6b3f08e9fdd919e97e47bd857cbd8935fdcbf367d20b5b8c545f279e796e` |
|
|
| `models/db/sensitive_sql_test.go` | `f0f74c09a9e96a6529db7b9ce459a2ea37e204de38c5ad01855b80c9a992a769` |
|
|
|
|
Both actual OAuth CLI handlers preserve the marked context through database
|
|
queries. They refuse configured raw SQL logging **and** actual XORM logger
|
|
ShowSQL before source reads/writes; a configuration boolean alone is insufficient.
|
|
Private-file persistence failures return fixed errors. This deliberately refuses
|
|
debug SQL logging for these handlers instead of pretending it is a private path.
|
|
The legacy secret flag and update omission semantics otherwise remain intact.
|
|
Final controls include actual `LOG_SQL=true` refusal, low-threshold slow-query
|
|
hooks, and a real SQLite-triggered write failure with unchanged stored source.
|