SeaQL/sea-orm

The following risks are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include database configuration, SQL construction, authorization snapshots, filesystem generation, and subprocess execution. Migration and synchronous-generation utilities have broad side effects that deserve particular attention during future authorized work.

• Hypothesis: caller-controlled PostgreSQL schema strings could cross a SQL trust boundary because CLI sqlx_connect interpolates schema into SET search_path and marks the resulting string AssertSqlSafe; the runtime connector also constructs search-path SQL directly. Exploitability was not tested. (inferred)
  sea-orm-cli/src/commands/generate.rs#L457-L467src/driver/sqlx_postgres.rs#L98-L137
• Connection diagnostics can contain sensitive configuration: Database::connect includes the supplied URL in parsing/driver errors, ConnectOptions derives Debug with URL and SQLCipher fields, and metric callbacks receive statements with parameters.
  src/database/mod.rs#L94-L124src/database/mod.rs#L183-L214src/metric.rs#L8-L17
• Entity generation writes directly into a caller-selected output directory before rustfmt and final fallback checks; preservation excludes mod.rs, lib.rs, prelude.rs, and active-enum files, while parse fallback preserves old source as comments rather than active code.
  sea-orm-cli/src/commands/generate.rs#L371-L436sea-orm-codegen/src/merge/mod.rs#L157-L175
• Migration tooling launches cargo with a selected manifest and inherited/overridden database environment; update_migrator rewrites Rust through timestamp-module and vec! regexes, truncates the destination after backing it up, and removes the backup after writing.
  sea-orm-cli/src/commands/migrate.rs#L43-L74sea-orm-cli/src/commands/migrate.rs#L239-L281
• Hypothesis: application code retaining ordinary DatabaseConnection handles can bypass optional RBAC wrappers, and policy changes require explicit engine replacement to affect the loaded snapshot. RestrictedConnection checks structured statements, whereas the underlying connection remains available. (inferred)
  src/database/db_connection.rs#L33-L38src/database/db_connection.rs#L619-L648src/database/restricted_connection.rs#L60-L90src/database/restricted_connection.rs#L505-L557
• Migration atomicity is conditional: defaults wrap PostgreSQL migrations but not MySQL/SQLite, with per-migration overrides; the nontransactional branch executes migration.up before inserting its tracking record. fresh invokes database-wide table/type dropping within its discovered scope.
  sea-orm-migration/src/lib.rs#L35-L41sea-orm-migration/src/migrator/exec.rs#L200-L204sea-orm-migration/src/migrator/exec.rs#L267-L282sea-orm-migration/src/migrator/exec.rs#L157-L183
• ProxyDatabaseTrait defaults transaction hooks to no-ops and ping to success; the GlueSQL example supports limited value/payload variants, contains panic/todo branches, and returns fixed last_insert_id and rows_affected values.
  src/database/proxy.rs#L8-L30examples/proxy_gluesql_example/src/main.rs#L38-L60examples/proxy_gluesql_example/src/main.rs#L98-L113examples/proxy_gluesql_example/src/main.rs#L122-L130
• make-sync.sh deletes and recopies the synchronous source/test trees, then applies broad textual transformations to async syntax, trait bounds, streams, and locks; its blast radius includes synchronized tests and examples, so isolated mirror edits can be overwritten.
  build-tools/make-sync.sh#L23-L50build-tools/make-sync.sh#L51-L71build-tools/make-sync.sh#L81-L95