Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

truera/trulens

              main @ 0a3956a
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

SQL Injection: 4 prior fixes. Scrutinize any change in this area.

src/connectors/snowflake/trulens/connectors/snowflake/dao/run.py: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Execution of raw, unparameterized SQL queries via Snowflake's Snowpark session risks complete database compromise. Ensuring query parameterization is crucial here and in sibling components.

SQL Injection: Unvalidated user-controlled strings (like streamlit dashboard names) interpolation in staged file commands ('PUT file://') allows attackers to perform SQL injection and command abuse.

SQL Injection: Failure to validate administrative identifiers (database, schema, and warehouse names) when executing dynamic setup queries permits SQL injection, requiring strict alphanumeric validation.