{"repo":"timescale/pgspot","free":true,"listed":false,"github":"https://github.com/timescale/pgspot","clone":"git clone https://github.com/timescale/pgspot.git","description":"Spot vulnerabilities in postgres SQL scripts","language":"Python","stars":147,"topics":["postgresql","security","python"],"license":"PostgreSQL","category":"security-tools","readme_excerpt":"pgspot Spot vulnerabilities in PostgreSQL extension scripts. pgspot checks extension scripts for following PostgreSQL security best practices. In addition to checking extension scripts it can also be used to check security definer functions or any other PostgreSQL SQL code. pgspot checks for the following vulnerabilities: - search path-based attacks - unsafe object creation Consult the [reference] for detailed documentation of the vulnerabilities which pgspot detects, and their potential mitigations. [reference]: https://github.com/timescale/pgspot/blob/main/REFERENCE.md Useful links - PostgreSQL security recommendations for extensions - PostgreSQL security recommendations for SECURITY DEFINER functions Installation pip install pgspot Requirements - python = 3.10 - pglast - libpg query (through pglast) To install the runtime requirements, use pip install -r requirements.txt . Usage SQL-accepting functions It is a common pattern that SQL-accepting functions exist, which take a string-like argument which will be executed as SQL. This can \"hide\" some SQL from pgspot, as the string-like argument masks the SQL. With the --sql-accepting argument, pgspot can be told about such functions. Assuming a function named execute sql which takes a SQL string as its first argument, and executes it. With pgspot --sql-accepting=execute sql we can tell pgspot execute sql may accept SQL. pgspot will attempt to unpack and evaluate all arguments to that function as SQL.","default_branch":null,"files":null,"tree":[],"storefront":"/r/timescale","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/timescale/pgspot/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}