The module level connect method is guarded by PySys_Audit(), but sqlite3.Connection.__init__() is not. It is possible to bypass the module level connect() method simply by creating a new sqlite3.Connection object directly.

Easily fixed by either moving the PySys_Audit() check to pysqlite_connection_init(), or by adding an extra check in pysqlite_connection_init().


>>> import sqlite3, sys
>>> def hook(s, e):
...     if s == 'sqlite3.connect':
...             raise PermissionError
... 
>>> sys.addaudithook(hook)
>>> sqlite3.connect(':memory:')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<stdin>", line 3, in hook
PermissionError
>>> sqlite3.Connection(':memory:')
<sqlite3.Connection object at 0x7f94b0157a80>

Steve, is it worth it to improve this?

Yes, let's move it into the init function.

The PR accidentally fixes a bug in GH-25246 (bpo-43762):
The object passed to PySys_Audit() is now the connection object, not the module object.

Steve, can we get this in before beta1 (bco. the bugfix)?

New changeset c96cc089f60d2bf7e003c27413c3239ee9de2990 by Erlend Egeberg Aasland in branch 'master':
bpo-43434: Move sqlite3.connect audit events to sqlite3.Connection.__init__ (GH-25818)
https://github.com/python/cpython/commit/c96cc089f60d2bf7e003c27413c3239ee9de2990

We could get this one in after beta 1 anyway, but sure, it's in.

The backports are going to have to be manual, I suspect...

Thanks! :) I'll fix the backports.

Thanks, Erlend! Appreciate how quickly you got onto that, and the quality of your work.

New changeset cbb7b9ed4a6069a2cb2e2f809926c2cfa332a493 by Erlend Egeberg Aasland in branch 'master':
bpo-43434: Clean up sqlite3.connect() after GH-25818 (GH-25823)
https://github.com/python/cpython/commit/cbb7b9ed4a6069a2cb2e2f809926c2cfa332a493

Thanks, Steve, that means a lot! Glad to help. Thank you for getting it into beta1. Having the new event out there with the wrong object passed to it would have been a tiny bit embarrassing :)

New changeset ad73d1657ca3591b1dd1d15bb80ce83ca7fc3223 by Erlend Egeberg Aasland in branch '3.9':
bpo-43434: Move sqlite3.connect audit event to sqlite3.Connection.__init__ (GH-25818)
https://github.com/python/cpython/commit/ad73d1657ca3591b1dd1d15bb80ce83ca7fc3223

New changeset 10665ac37313560fe87460cf4a5c26677049bf62 by Erlend Egeberg Aasland in branch '3.8':
bpo-43434: Move sqlite3.connect audit events to sqlite3.Connection.__init__ (GH-25818)
https://github.com/python/cpython/commit/10665ac37313560fe87460cf4a5c26677049bf62