Sealmarkdocs methodology 0.3-draft
methodology 0.3-draft

sqlite-mutating-sql

SQLite: mutating SQL blocked

shipped

The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain sqlite-mutating-sql.

pack
sqlite
weight
critical
scope
server (tested through its SQL tool against a seeded SQLite file; the engine itself is not what is graded; SQLite only in this release, DuckDB is planned)
decided by
db-state
since
0.2-draft (methodology 0.3-draft)
config keys
checks.sqlite-mutating-sql.corpus.addchecks.sqlite-mutating-sql.corpus.removechecks.sqlite-mutating-sql.enabledchecks.sqlite-mutating-sql.severity

Probes

  • stacked-insert SELECT 1; INSERT INTO probe_t (id, v) VALUES (9002, 'stacked') core
  • comment-obfuscation /*x*/ iNsErT INTO probe_t (id, v) VALUES (9003, 'obf') core
  • cte-insert WITH x AS (SELECT 1) INSERT INTO probe_t SELECT 9004, 'cte' FROM x core
  • replace-into REPLACE INTO probe_t (id, v) VALUES (9005, 'replace')
  • upsert INSERT INTO probe_t (id, v) VALUES (9006, 'upsert') ON CONFLICT (id) DO UPDATE SET v = 'x'
  • create-table CREATE TABLE sm_ddl (x int)
  • alter-table ALTER TABLE probe_t ADD COLUMN sm int
  • drop-table DROP TABLE audit_probe
  • pragma-user-version PRAGMA user_version = 7
  • pragma-journal-mode PRAGMA journal_mode = wal

core marks the canonical probes of the check; the others are extra coverage. How they decide the verdict is stated under How the verdict is established.

Settings and thresholds

Every check also takes checks.sqlite-mutating-sql.enabled and checks.sqlite-mutating-sql.severity; they are described once in the configuration reference.

This check has no numeric threshold.

KeyDefaultStandardMeaning
checks.sqlite-mutating-sql.corpus.add[]lockedExtra probes for sqlite-mutating-sql, validated against the pack's corpus schema. Appends across layers. Any addition makes the run CUSTOM.
checks.sqlite-mutating-sql.corpus.remove[]lockedProbe ids or exact strings to drop from the sqlite-mutating-sql corpus. Appends across layers. Any removal makes the run CUSTOM.

How the verdict is established

  • Scoring. critical and scored: pass = 1 point, part = 0.5, fail = 0. A fail caps the pack's grade at D, whatever the other checks scored.

What to fix

Parse the statement instead of prefix-matching; reject stacked statements, writes inside CTEs, PRAGMA changes and comment-obfuscated forms, and open the connection read-only.

False positives

A server that deliberately offers a second tool for writes is judged on the read tool only; a write-capable tool declared as a writer is listed under not covered. PRAGMA writable_schema = 1 is excluded because it changes nothing without a following write.

False negatives

Only the statement forms in the published corpus are tried; a server that blocks those and allows another form still passes. The engine's own configuration (compile options, authorizer) is not inspected.