v7.2.3 — Code, Secret and SQL Verification Fixes

v7.2.3 — Code, Secret and SQL Verification Fixes

Fail-closed security release. No breaking wire changes; the code and SQL verifiers are stricter (see Behaviour changes). Upgrade from any <= 7.2.2 deployment is recommended.

Three coordinated security advisories are addressed in this release. Their pages, with CVEs, will be published on the repository Security tab.

Security fixes

• Code verification — shell and process execution admitted.
  verify_code treated os.system, os.popen and subprocess calls as warnings, so code that runs shell commands came back VERIFIED with is_valid: true and admission ADMIT, even when caller input reached the shell. verify_python_deep and POST /verify/code returned the same result. Shell and process execution is now a blocking finding (process_execution), so such code is never admitted. This covers:

  • os.system, os.popen, the os.exec* and os.spawn* families, os.posix_spawn* and os.startfile
  • subprocess.*, pty.spawn and asyncio.create_subprocess_*
  • calls through an aliased import (import subprocess as sp, from os import system as run_it, from os import *)

  (src/qwed_new/core/code_verifier.py)

• Secret detection — project-scoped OpenAI keys missed.
  ConfigGuard and the code verifier matched OpenAI keys with patterns that cannot match the - in sk-proj-, sk-svcacct- and sk-admin- keys, so a configuration holding one was reported as containing no secret. Both now detect these keys as well as legacy ones. Anthropic sk-ant- keys are unaffected. (qwed_sdk/guards/config_guard.py, src/qwed_new/core/code_verifier.py)

• SQL verification — executable comments and undeclared tables.
  MySQL and MariaDB run the SQL inside /*! ... */ comments, but the verifier treated it as a comment, so a tautology such as /*!50000 OR 1=1 */ was admitted. With schema_ddl, a query on a table outside the schema was only a warning and was admitted. Executable comments are now expanded before analysis, and a table outside the declared schema is an admission failure (sql_verifier.schema_violation). (src/qwed_new/core/sql_verifier.py)

Behaviour changes

• Code that runs a shell command or subprocess is no longer admitted by the code verifier, even with a constant argument.
• With schema_ddl, a reference to an undeclared table returns is_valid: false with sql_verifier.schema_violation. Names defined by the query itself (CTEs) are not tables. Without schema_ddl, tables are not checked.
• Executable comments are analysed as SQL whatever the declared dialect; developer_fields.executable_comments_expanded reports it.

No response field is removed or renamed.

Soundness eval

From this release on, each release carries eval-results.json. The eval runs claims with a known answer through the Math, Logic, SQL, Code and Schema engines, including reproductions of past advisories. A claim that does not hold but is accepted fails CI. See evals/README.md.

Upgrade

• PyPI: qwed==7.2.3
• npm: @qwed-ai/sdk@7.2.3
• crates.io: qwed = "7.2.3"
• Docker: qwedai/qwed-verification:7.2.3
• GitHub Action: QWED-AI/qwed-verification@v7.2.3

Full changelog: see CHANGELOG.md.