snowflakedb / snowflakedb/snowflake-connector-python
SNOW-3324331: client_prefetch_threads validation can bypass the lower bound due to ordering of casting and bounds checks
@sfc-gh-snow-drivers-warsaw-dl is already working on this.
Since Apr 7, 2026.
- Dominant language
- Python
- Stars
- 730
- Forks
- 574
- Avg merge
- 5h 45m
- Merged PRs (30d)
- 16
Description
While looking at _validate_client_prefetch_threads() in src/snowflake/connector/connection.py, I noticed that bounds checking is performed before the value is converted to an integer, and then the value is unconditionally reassigned using int(self.client_prefetch_threads) afterward.
Because of this ordering, fractional values between 0 and 1 can bypass the lower-bound check.
For example, if 0.5 is provided:
- The bounds check evaluates
0.5 <= 0as false, so no correction is applied - The value is then converted using
int(0.5), which results in0 - The final stored value becomes
0, even though the intended minimum is1
In practice, this can happen when values come from configuration files, environment variables, or computed expressions (for example, scaling based on CPU count), where non-integer values may be passed unintentionally.
The issue is that conversion and validation are happening in the wrong order, and the value is reassigned after the bounds checks have already run. A more robust approach would be to read the raw value once, convert it once, then apply bounds checks before storing the final result.
I’d be happy to open a PR with a fix and accompanying tests if this approach sounds reasonable.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.