How to prevent SQL injection in Snowflake after using LIKE keyword? - snowflake-cloud-data-platform

Question

I use the following function for the connection with the Snowflake. For SQL injection prevention I use paramstyle = "numeric".
import snowflake.connector
def get_snowflake_connector(
user: str,
password: str,
account: str,
warehouse: str,
role: str,
):
params = {
"user": user,
"password": password,
"account": account,
"warehouse": warehouse,
"role": role,
}
snowflake.connector.paramstyle = "numeric"
conn = snowflake.connector.connect(**params)
return conn
So, when I use returned connection object conn I can execute queries over Snowflake. For example:
conn.cursor().execute(query, params)
Where query is for example:
query = """
SELECT *
FROM IDENTIFIER(:1)
LIMIT :2;
"""
and params are string replacements for places where we have :1 and :2. In this case, for example, params=("DATABASE_NAME.SCHEMA_NAME.TABLE_NAME", 100000).
So, the result is like this:
conn.cursor().execute(
"SELECT * FROM IDENTIFIER(:1) LIMIT :2;", params=("DATABASE_NAME.SCHEMA_NAME.TABLE_NAME", 100000)
)
And this is working. I use IDENTIFIER(:N) for the objects and without it, I use :N for literals.
But the problem appears when I use LIKE keyword. For example, query = "SHOW USERS LIKE 'some_user'".
What should I use instead of 'some_user'? IDENTIFIER(:1) doesn't work because it is not an object, but also :1 doesn't work. And I wonder what is the solution to prevent this from SQL injection?

Answer 1

There is a workaround but it uses two queries instead of one.
One could use:
conn.cursor().execute('SHOW USERS')
conn.cursor().execute('SELECT * FROM TABLE(RESULT_SCAN(LAST_QUERY_ID()) WHERE "name" = :1', ('some_user',))
This way SQL injection is prevented, but this is more time-consuming.

Answer 2

I don't think "paramstyle" has anything to do with the problem, but check the docs: "The percent character (“%”) is both a wildcard character for SQL LIKE and a format binding character for Python. If you use format binding, and if your SQL command contains the percent character, you might need to escape the percent character". You might also have to double-up on your quotes.
This does not help with the SQL injection question though. Snowflake has no equivalent to Oracle's dbms_assert package for a start. Proceed with extreme caution: sanity check the various binds first, at the very least.

Answer 3

This could be the answer:
select * from snowflake.account_usage.users where name = 'slobokv83';
and with SQL injection prevention:
conn.cursor().execute('select * from snowflake.account_usage.users where name = :1', ('slobokv83',))
The same goes for "snowflake.account_usage.roles":
conn.cursor().execute('select * from snowflake.account_usage.roles where name = :1', ('role_name',))
and for "snowflake.account_usage.databases" column "name" is "database_name":
conn.cursor().execute('select * from snowflake.account_usage.databases where database_name = :1', ('database_name',))
However, this is more time-consuming than simple
SHOW USERS LIKE 'slobokv83'