From ad73d1657ca3591b1dd1d15bb80ce83ca7fc3223 Mon Sep 17 00:00:00 2001 From: Erlend Egeberg Aasland Date: Mon, 3 May 2021 00:43:06 +0200 Subject: bpo-43434: Move sqlite3.connect audit event to sqlite3.Connection.__init__ (GH-25818) --- .../next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst | 4 ++++ Modules/_sqlite/connection.c | 4 ++++ Modules/_sqlite/module.c | 10 +--------- 3 files changed, 9 insertions(+), 9 deletions(-) create mode 100644 Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst diff --git a/Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst b/Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst new file mode 100644 index 0000000..28b7fc5 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst @@ -0,0 +1,4 @@ +Creating a :class:`sqlite3.Connection` object now also produces +a ``sqlite3.connect`` :ref:`auditing event `. +Previously this event was only produced by :func:`sqlite3.connect` +calls. Patch by Erlend E. Aasland. diff --git a/Modules/_sqlite/connection.c b/Modules/_sqlite/connection.c index d20339c..df4e946 100644 --- a/Modules/_sqlite/connection.c +++ b/Modules/_sqlite/connection.c @@ -96,6 +96,10 @@ int pysqlite_connection_init(pysqlite_Connection* self, PyObject* args, PyObject return -1; } + if (PySys_Audit("sqlite3.connect", "O", database_obj) < 0) { + return -1; + } + database = PyBytes_AsString(database_obj); self->initialized = 1; diff --git a/Modules/_sqlite/module.c b/Modules/_sqlite/module.c index 71d951e..4481183 100644 --- a/Modules/_sqlite/module.c +++ b/Modules/_sqlite/module.c @@ -71,8 +71,6 @@ static PyObject* module_connect(PyObject* self, PyObject* args, PyObject* int uri = 0; double timeout = 5.0; - PyObject* result; - if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|diOiOip", kwlist, &database, &timeout, &detect_types, &isolation_level, &check_same_thread, @@ -85,13 +83,7 @@ static PyObject* module_connect(PyObject* self, PyObject* args, PyObject* factory = (PyObject*)&pysqlite_ConnectionType; } - if (PySys_Audit("sqlite3.connect", "O", database) < 0) { - return NULL; - } - - result = PyObject_Call(factory, args, kwargs); - - return result; + return PyObject_Call(factory, args, kwargs); } PyDoc_STRVAR(module_connect_doc, -- cgit v0.12