diesel-rs/diesel

These findings describe source-level trust boundaries and review hotspots, not runtime-confirmed vulnerabilities. Database operations can mutate remote databases or local files, and raw SQL reduces compile-time validation. Migration commits and schema-file verification occur at different stages. The advanced blog example contains security-relevant teaching shortcuts and an update target that warrants focused review.

• Source observation: EditComment loads a comment scoped to the current user, but executes diesel::update(comments) without a filter or identified-record target; the update construction does not preserve the preceding ownership selection.
  examples/postgres/advanced-blog-cli/src/main.rs#L116-L128
• Source observation: blog registration hashes passwords with Argon2 using a constant salt; the implementation explicitly warns against this pattern in real applications.
  examples/postgres/advanced-blog-cli/src/auth.rs#L10-L10examples/postgres/advanced-blog-cli/src/auth.rs#L80-L99
• Operational boundary: database reset calls drop before setup; server backends execute DROP DATABASE, while SQLite drop removes an existing path supplied as database_url.
  diesel_cli/src/database.rs#L257-L264diesel_cli/src/database.rs#L410-L440diesel_cli/src/database.rs#L443-L474
• Source observation: --locked-schema validation runs after migrations; a schema mismatch returns SchemaWouldChange, and the inspected dispatch provides no enclosing rollback around migration execution and file comparison.
  diesel_cli/src/migrations/mod.rs#L207-L214diesel_cli/src/main.rs#L308-L325diesel_migrations/src/migration_harness.rs#L191-L201
• Migration metadata read/parse errors are discarded by unwrap_or_default; transaction-disabled migrations execute SQL and insert bookkeeping without the harness transaction wrapper.
  diesel_migrations/src/file_based_migrations.rs#L176-L185diesel_migrations/migrations_internals/src/lib.rs#L36-L54diesel_migrations/src/migration_harness.rs#L178-L195
• Raw SqlQuery binds cannot validate SQL placeholder types or parameter counts, and dynamic schemas cannot verify runtime table/column existence or declared types; these are documented reductions in static guarantees.
  diesel/src/query_builder/sql_query.rs#L34-L46diesel_dynamic_schema/src/lib.rs#L13-L27
• Native PostgreSQL execution crosses unsafe libpq boundaries for connection pointers and parameter arrays; Statement::execute includes explicit i32 conversion checks, so preserving ownership and bounds behavior is essential when editing this code.
  diesel/src/pg/connection/raw.rs#L19-L46diesel/src/pg/connection/stmt/mod.rs#L26-L89
• External trust boundaries include PATH-resolved rustfmt, VISUAL/EDITOR-selected subprocesses, temporary editor files, and configured schema/patch paths; relative paths are joined to the config directory without a repository-containment check in the inspected code.
  diesel_cli/src/print_schema.rs#L899-L923examples/postgres/advanced-blog-cli/src/editor.rs#L8-L35diesel_cli/src/config.rs#L546-L556diesel_cli/src/main.rs#L294-L325