Skip to content

0.5.0 - Sandbox strengthening

Latest
Latest

Choose a tag to compare

View all tags
@julien040 julien040 released this 05 Aug 20:39
· 3 commits to main since this release
0.5.0
07699b5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Warning

Vulnerabilities Patch

This release addresses the security advisories GHSA-rj3v-75f4-r542, GHSA-fcq2-h3m5-5rm3, GHSA-7jrp-4mmv-mw39, GHSA-4rr9-66j6-r74m and GHSA-xhv3-pjg4-555g

Please update Anyquery as soon as possible to 0.5.0 or later

Changes

  • Breaking: s3:// and gcs:// URLs are no longer supported directly. Query a presigned (S3) or signed (GCS) URL over plain HTTPS instead.
  • New: paste a normal share link from GitHub, GitHub Gist, GitLab, Codeberg, Hugging Face, Google Sheets, or Dropbox, and Anyquery rewrites it to the raw file URL for you.
  • New: read_file reads any supported format (CSV, TSV, JSON, JSONL, Parquet, TOML, YAML, HTML) picked from the file extension, so you don't need to name the reader yourself. format= overrides detection when the extension is missing or misleading.
  • New: read_csv auto-detects the delimiter, header row, and column types when you don't specify them.
  • Sandbox hardening: fixed a bypass where an ATTACH DATABASE/VACUUM INTO target with a repeated mode= query parameter (e.g. file:x?mode=memory&mode=rwc) was classified as in-memory and allowed, while SQLite actually opened it read-write on disk. Also closed a gap where the developer-mode UDFs (load_dev_plugin, reload_dev_plugin, unload_dev_plugin) stayed registered under an active sandbox and could read arbitrary local files.
  • anyquery run no longer executes dot commands: query files fetched from a URL, S3 bucket, or Query Hub ID could contain .shell or .system and run local commands. Dot and slash commands are now disabled for that execution path.

What is Anyquery?

Anyquery is a query engine that allows you to query anything over SQL.
Whether it's a local CSV, a Google Sheet, your Apple notes, or your GitHub stars, you can query it with Anyquery.

It's built on top of SQLite, and you can use alternative languages like PRQL and PQL to query your data.

Get started at anyquery.dev

Anyquery

Changelog

  • bb40015 Add internship banner
  • 027e84d Fix sandbox escaping
  • 22296f7 Merge pull request #81 from julien040/website/preview
  • eb38f5f Merge pull request #85 from mikemikimike/fix/82-postgres-identifier-quoting
  • 07699b5 Merge pull request #87 from julien040/0.5.0-release
  • de5e91b Remove go-getter to fix vulnerabilities
  • 981f706 Wrong link for resume
  • 68ff1f2 fix(postgres): quote identifiers exactly once
Assets 16
Loading