SQLVerifier admits credential-dumping and tautology-injection queries (SELECT * bypasses the sensitive-column denylist; tautology check matches exact shapes only)

Impact

Two checks in SQLVerifier.verify_sql can be bypassed so a query is certified VERIFIED/ADMIT.

1. Sensitive-column denylist bypass. The column check only inspects explicitly named columns. A star query over a table whose schema_ddl declares a sensitive column (for example password) — SELECT * FROM users — is admitted, while SELECT password FROM users is correctly BLOCKED. u.*, a star over a join, and queries referencing undeclared columns are also admitted (column existence is never checked).

2. Tautology detection matches exact AST shapes only. The always-true detectors recognise a fixed set of shapes. Equivalent always-true predicates such as OR 1, OR NOT FALSE, 1 = 1.0 and OR 2 > 1 are certified VERIFIED/ADMIT, while OR TRUE and OR 1=1 are BLOCKED.

The two compose into one admitted credential-dumping query.

Affected

All releases through 7.2.3; reproduced on main @ a4d6714. The 7.2.3 schema change blocks a few variants (for example a star over a table outside the declared schema) only when schema_ddl is supplied.

Details

• src/qwed_new/core/sql_verifier.py: the column check (around 420-434), DDL columns collected but not used against star expansion (around 645-657), the tautology/OR-TRUE detectors (around 445-465).
• admission_decision (diagnostics.py:1114-1136) maps the VERIFIED result to ADMIT.

Fix

Expand SELECT * (and t.*) against the declared schema before the sensitive-column check, and reject a query whose columns cannot be resolved against a declared schema. Replace the shape-list tautology check with a value-level always-true test. These are a screening aid, not a substitute for least-privilege database accounts.

Source

OpenVuln external audit (2026-10). Reported privately; not previously disclosed.