
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
sqltree
is an experimental parser for SQL, providing
a syntax tree for SQL queries. Possible use cases include:
sqltree
can parse queries:
$ python -m sqltree "SELECT * FROM x WHERE x = 3"
Select(select_exprs=[SelectExpr(expr=Star(), alias=None)], table=Identifier(text='x'), conditions=BinOp(left=Identifier(text='x'), op=Punctuation(text='='), right=IntegerLiteral(value=3)))
And format them:
$ python -m sqltree.formatter "SELECT * from x where x=3"
SELECT *
FROM x
WHERE x = 3
SQL is a big language with a complicated grammar that varies significantly
between database vendors. sqltree
is designed to be flexible enough to parse
the full syntax supported by different databases, but I am prioritizing
constructs used in my use cases for the parser. So far, that has meant a focus
on parsing MySQL 8 queries. Further syntax will be added as I have time.
Useful features of sqltree
include:
sqltree
supports placeholders such as %s
or ?
in various positions in
the query, so that queries using such placeholders can be formatted and analyzed.
$ python -m sqltree.formatter 'select * from x where y = 3 %(limit)s'
SELECT *
FROM x
WHERE y = 3
%(limit)s
sqltree
's handwritten parser often produces better error messages than MySQL
itself. For example:
$ mysql
mysql> show replicca status;
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'replicca status' at line 1
$ python -m sqltree 'show replicca status'
Unexpected 'replicca' (expected one of REPLICA, SLAVE, REPLICAS, TABLES, TABLE, TRIGGERS, VARIABLES, STATUS, COUNT, WARNINGS, ERRORS, COLUMNS, FIELDS, INDEX, INDEXES, KEYS)
0: show replicca status
^^^^^^^^
sqltree.sqltree
: parse a SQL query and return the parse tree. See sqltree.parser
for the possible parse nodes.sqltree.formatter.format
: reformat a SQL query.sqltree.tools.get_tables
: get the tables referenced in a SQL query.More detailed documentation to follow.
sqltree
runs on Python 3.6 and up and it has no dependencies.
sqltree embeds a fixit rule for formatting SQL. Here is how to use it:
pip install fixit
python -m fixit.cli.init_config
python -m fixit.cli.apply_fix --rules sqltree.fixit.SqlFormatRule path/to/your/code
NOT
operatorLEFT JOIN
and similar queriesSELECT ... INTO
syntaxSET TRANSACTION
syntaxa MOD B
and a DIV b
syntaxGROUP_CONCAT()
syntaxFAQs
A SQL parser.
We found that sqltree demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.