#3681 fix(security): 2 improvements across 2 files Pull request opened by tomaioo Summary fix(security): 2 improvements across 2 files Problem Severity:

Medium

| File:

packages/meltano-tap-sqlite/tap_sqlite/tap.py:L32

In packages/meltano-tap-sqlite/tap_sqlite/tap.py, the get_sqlalchemy_url method constructs a SQLite URL using an f-string with direct interpolation of config[DB_PATH_CONFIG]. If the database path contains malicious input, this could potentially lead to path traversal or unexpected file access. While less severe than SQL injection, unsanitized path construction can lead to security vulnerabilities. Solution Validate and sanitize the database path before using it in the connection string. Use pathlib.Path to normalize the path and ensure it points to an expected location. Consider restricting to absolute paths or validating against a whitelist of allowed directories. Changes •

packages/meltano-tap-sqlite/tap_sqlite/tap.py

(modified) •

singer_sdk/_logging.py

(modified) Summary by Sourcery Strengthen security around logging configuration loading and SQLite connection URL construction. Bug Fixes: • Prevent unsafe construction of SQLite SQLAlchemy URLs by resolving the database path to a normalized filesystem path. Enhancements: • Validate YAML-based logging configurations to ensure they are dicts with only allowed top-level keys and safe handler classes before applying them. meltano/sdk