A name-matching SQL scanner missed four of five documented injection CVEs

Name matching is a decision about how much of a program you are willing to read. inlet picks out the call sites that look like SQL execution, raw DB API calls, Django's .raw() and .extra(), SQLAlchemy's text(), and labels each one parameterized, concatenated, or uncertain ^[1]. Everything it decides, it decides from inside one function; the author calls that boundary a cross-function scope wall and treats it as a hard limit ^[15].

Archery's CVE-2023-30556 is the case to study. Whether it counts as a catch depends on whether anyone opens the uncertain bucket. The exact vulnerable line did come out of the scan, labelled uncertain instead of concatenated. The f-string assignment turned out to sit inside a try: block that inlet's name resolution did not follow into ^[7].

The scan itself is cheap. About 772,000 lines of unmodified code went through in roughly 10.6 seconds ^[5], which works out at about 73,000 lines a second ^[16].

The noise-floor group found the bug that hand-written fixtures could not. peewee's query builder exposes an .execute(database) method that has nothing to do with a cursor's .execute(sql), and that collision accounted for 67 percent of the uncertain findings in the package ^[10]. The fix asked for positive evidence before treating an .execute()-shaped call as a database idiom: a string-shaped argument, or a .cursor() call in the receiver chain, or a conventional cursor or connection name ^[11]. On peewee it did exactly what it was built to do, cutting 33 uncertain findings to 9, with a diff confirming all 24 removals were the collision shape and no true positives lost ^[12].

Then the same rule ran over the other nine packages and silently dropped 94 real database call sites. Among them were Django's SchemaEditor.execute(), SQLAlchemy's Engine and Session internals and SQLModel's super().execute(), all lost because the receiver was named something generic like self ^[13]. The trade was 94 real call sites for 24 false ones, close to four to one ^[17].

On the revert, inlet's author wrote that "there is no way to tell a real DB wrapper from an unrelated same-named method using local syntax alone" ^[14]. The rule came out instead of being tuned further, and self.execute(x) went into the docs beside the scope wall as a limit of the approach ^[15].

For the 0 for 5 to say anything about your repository, the shape has to match. Group A was five packages chosen because a documented CVE existed and its fix commit or advisory could be located in advance ^[3]. Four of those bugs lived in framework or provider code, several calls from any name inlet knows ^[8]. If your SQL is a cursor.execute() carrying an f-string inside a view function, the seven original fixtures describe your code and the 0 for 5 does not ^[2]. A README that reports seven for seven is reporting on seven files someone wrote in order to be reported on. If your data access goes through a repository class or a task helper, you are the four, and the author put the 0/5 at the top of EVALUATION.md ^[9].