{"record":{"id":"6e851f5646450cf4","repo":"JuliusBrussee/caveman","slug":"sqlite-parent-q-grants-broad-windows-write-access","errorCode":null,"errorMessage":"sqlite parent %q grants broad Windows write access","messagePattern":"sqlite parent %q grants broad Windows write access","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/ccr/sqlite_parent_security_windows.go","lineNumber":34,"sourceCode":"\t\twindows.SE_FILE_OBJECT,\n\t\twindows.DACL_SECURITY_INFORMATION,\n\t)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"inspect sqlite parent ACL %q: %w\", path, err)\n\t}\n\tif descriptor == nil {\n\t\treturn fmt.Errorf(\"sqlite parent %q has no security descriptor\", path)\n\t}\n\tdacl, _, err := descriptor.DACL()\n\tif err != nil || dacl == nil {\n\t\treturn fmt.Errorf(\"sqlite parent %q has no restrictive DACL\", path)\n\t}\n\tbroad, err := windowsACLGrantsBroadWrite(dacl)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"inspect sqlite parent ACL %q: %w\", path, err)\n\t}\n\tif broad {\n\t\treturn fmt.Errorf(\"sqlite parent %q grants broad Windows write access\", path)\n\t}\n\treturn nil\n}\n\nfunc windowsACLGrantsBroadWrite(dacl *windows.ACL) (bool, error) {\n\tbroadSIDs := make([]*windows.SID, 0, 4)\n\tfor _, sidType := range []windows.WELL_KNOWN_SID_TYPE{\n\t\twindows.WinWorldSid,\n\t\twindows.WinAuthenticatedUserSid,\n\t\twindows.WinBuiltinUsersSid,\n\t\twindows.WinBuiltinGuestsSid,\n\t} {\n\t\tsid, err := windows.CreateWellKnownSid(sidType)\n\t\tif err != nil {\n\t\t\treturn false, err\n\t\t}\n\t\tbroadSIDs = append(broadSIDs, sid)\n\t}","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/engine/ccr/sqlite_parent_security_windows.go#L16-L52","documentation":"Error \"sqlite parent %q grants broad Windows write access\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at engine/ccr/sqlite_parent_security_windows.go:34 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove broad write access grants from the sqlite parent directory."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}