klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

Pr@main@fix embedded security vulnerabilities (#1271)

Browse Source 
* fix: Embedded security vulnerabilities

* perf: Optimize embedded APIs
This commit is contained in:
fit2cloud-chenyw
2026-07-14 17:23:42 +08:00
committed by GitHub
parent a70eb1b308
commit 0b4878199f
5 changed files with 81 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/system/api/assistant.py
+2 -2
View File
@@ -313,13 +313,13 @@ async def update(request: Request, session: SessionDep, editor: AssistantDTO):
dynamic_upgrade_cors(request=request, session=session)
@router.get("/{id}", response_model=AssistantModel, summary=f"{PLACEHOLDER_PREFIX}assistant_query_api", description=f"{PLACEHOLDER_PREFIX}assistant_query_api")
""" @router.get("/{id}", response_model=AssistantModel, summary=f"{PLACEHOLDER_PREFIX}assistant_query_api", description=f"{PLACEHOLDER_PREFIX}assistant_query_api")
async def get_one(session: SessionDep, id: int = Path(description="ID")):
db_model = await get_assistant_info(session=session, assistant_id=id)
if not db_model:
raise ValueError(f"AssistantModel with id {id} not found")
db_model = AssistantModel.model_validate(db_model)
return db_model
return db_model """
@router.delete("/{id}", summary=f"{PLACEHOLDER_PREFIX}assistant_del_api", description=f"{PLACEHOLDER_PREFIX}assistant_del_api")
frontend/src/api/assistant.ts
+1 -1
View File
@@ -6,6 +6,6 @@ export const assistantApi = {
add: (data: any) => request.post('/system/assistant', data),
edit: (data: any) => request.put('/system/assistant', data),
delete: (id: number) => request.delete(`/system/assistant/${id}`),
query: (id: number) => request.get(`/system/assistant/${id}`),
// query: (id: number) => request.get(`/system/assistant/${id}`),
validate: (data: any) => request.get('/system/assistant/validator', { params: data }),
}
frontend/src/api/embedded.ts
+1 -1
View File
@@ -5,7 +5,7 @@ export const getAdvancedApplicationList = () =>
request.get('/system/assistant/advanced_application')
export const updateAssistant = (data: any) => request.put('/system/assistant', data)
export const saveAssistant = (data: any) => request.post('/system/assistant', data)
export const getOne = (id: any) => request.get(`/system/assistant/${id}`)
// export const getOne = (id: any) => request.get(`/system/assistant/${id}`)
export const delOne = (id: any) => request.delete(`/system/assistant/${id}`)
export const dsApi = (id: any) => request.get(`/datasource/ws/${id}`)
frontend/src/views/embedded/index.vue
+38 -43
View File
@@ -42,7 +42,6 @@ import {
watch,
} from 'vue'
import ChatComponent from '@/views/chat/index.vue'
import { request } from '@/utils/request'
import LOGO from '@/assets/svg/logo-custom_small.svg'
import icon_new_chat_outlined from '@/assets/svg/icon_new_chat_outlined.svg'
import { useAppearanceStoreWithOut } from '@/stores/appearance'
@@ -83,8 +82,8 @@ const loading = ref(true)
const tokenReady = ref(false)
const eventName = 'sqlbot_assistant_event'
let resolveTokenReady: (() => void) | null = null
const tokenReadyPromise = new Promise<void>((resolve) => {
let resolveTokenReady: ((data: any) => any) | null = null
const tokenReadyPromise = new Promise<any>((resolve) => {
resolveTokenReady = resolve
})
const communicationCb = async (event: any) => {
@@ -94,8 +93,8 @@ const communicationCb = async (event: any) => {
}
if (event.data['sqlbot_embedded_token']) {
assistantStore.setToken(event.data['sqlbot_embedded_token'])
resolveTokenReady?.()
tokenReady.value = true
const originData = event.data['sqlbot_origin_data']
resolveTokenReady?.(originData)
}
if (event.data?.busi == 'certificate') {
const certificate = event.data['certificate']
@@ -220,8 +219,6 @@ onBeforeMount(async () => {
validator.value = await assistantApi.validate(param)
assistantStore.setToken(validator.value.token) */
assistantStore.setAssistant(true)
loading.value = false
window.addEventListener('message', communicationCb)
const readyData = {
eventName: 'sqlbot_assistant_event',
@@ -231,46 +228,44 @@ onBeforeMount(async () => {
}
window.parent.postMessage(readyData, '*')
await tokenReadyPromise
request.get(`/system/assistant/${assistantId}`).then((res) => {
if (res.name) {
appName.value = res.name
const res = await tokenReadyPromise
loading.value = false
if (res?.name) {
appName.value = res.name
}
if (res?.configuration) {
const rawData = JSON.parse(res?.configuration)
assistantStore.setAutoDs(rawData?.auto_ds)
if (rawData.logo) {
logo.value = baseUrl + rawData.logo
}
if (res?.configuration) {
const rawData = JSON.parse(res?.configuration)
assistantStore.setAutoDs(rawData?.auto_ds)
if (rawData.logo) {
logo.value = baseUrl + rawData.logo
}
for (const key in customSet) {
if (
Object.prototype.hasOwnProperty.call(customSet, key) &&
![null, undefined].includes(rawData[key])
) {
customSet[key] = rawData[key]
configuredKeys.add(key)
}
for (const key in customSet) {
if (
Object.prototype.hasOwnProperty.call(customSet, key) &&
![null, undefined].includes(rawData[key])
) {
customSet[key] = rawData[key]
configuredKeys.add(key)
}
if (!rawData.theme) {
const { customColor, themeColor } = appearanceStore
const currentColor =
themeColor === 'custom' && customColor
? customColor
: themeColor === 'blue'
? '#3370ff'
: '#1CBA90'
customSet.theme = currentColor || customSet.theme
}
nextTick(() => {
setPageCustomColor(customSet.theme)
setPageHeaderFontColor(customSet.header_font_color)
})
}
})
if (!rawData.theme) {
const { customColor, themeColor } = appearanceStore
const currentColor =
themeColor === 'custom' && customColor
? customColor
: themeColor === 'blue'
? '#3370ff'
: '#1CBA90'
customSet.theme = currentColor || customSet.theme
}
nextTick(() => {
setPageCustomColor(customSet.theme)
setPageHeaderFontColor(customSet.header_font_color)
})
}
})
onBeforeUnmount(() => {
frontend/src/views/embedded/page.vue
+39 -38
View File
@@ -23,7 +23,6 @@ import { useAssistantStore } from '@/stores/assistant'
import { useAppearanceStoreWithOut } from '@/stores/appearance'
import { useI18n } from 'vue-i18n'
import { i18n } from '@/i18n'
import { request } from '@/utils/request'
import { setCurrentColor } from '@/utils/utils'
import { useUserStore } from '@/stores/user'
const userStore = useUserStore()
@@ -74,8 +73,8 @@ const divLoading = ref(true)
const tokenReady = ref(false)
const eventName = 'sqlbot_embedded_event'
let resolveTokenReady: (() => void) | null = null
const tokenReadyPromise = new Promise<void>((resolve) => {
let resolveTokenReady: ((data: any) => void) | null = null
const tokenReadyPromise = new Promise<any>((resolve) => {
resolveTokenReady = resolve
})
const communicationCb = async (event: any) => {
@@ -83,13 +82,16 @@ const communicationCb = async (event: any) => {
if (event.data?.messageId !== route.query.id) {
return
}
const assistantTypeObj = event.data['type']
if (
event.data['type'] &&
assistantTypeObj !== null &&
assistantTypeObj !== undefined &&
parseInt(event.data['type']) !== 4 &&
event.data['sqlbot_embedded_token']
) {
assistantStore.setToken(event.data['sqlbot_embedded_token'])
resolveTokenReady?.()
const originData = event.data['sqlbot_origin_data']
resolveTokenReady?.(originData)
tokenReady.value = true
}
if (event.data?.busi == 'certificate') {
@@ -228,42 +230,41 @@ onBeforeMount(async () => {
registerReady(assistantId)
await tokenReadyPromise
const res = await tokenReadyPromise
loading.value = false
request.get(`/system/assistant/${assistantId}`).then((res) => {
if (res?.configuration) {
const rawData = JSON.parse(res?.configuration)
assistantStore.setAutoDs(rawData?.auto_ds)
if (rawData.logo) {
logo.value = baseUrl + rawData.logo
}
rawData['name'] = rawData['name'] || res['name']
for (const key in customSet) {
if (
Object.prototype.hasOwnProperty.call(customSet, key) &&
![null, undefined].includes(rawData[key])
) {
customSet[key] = rawData[key]
configuredKeys.add(key)
}
}
if (!rawData.theme) {
const { customColor, themeColor } = appearanceStore
const currentColor =
themeColor === 'custom' && customColor
? customColor
: themeColor === 'blue'
? '#3370ff'
: '#1CBA90'
customSet.theme = currentColor || customSet.theme
}
nextTick(() => {
setPageCustomColor(customSet.theme)
})
if (res?.configuration) {
const rawData = JSON.parse(res?.configuration)
assistantStore.setAutoDs(rawData?.auto_ds)
if (rawData.logo) {
logo.value = baseUrl + rawData.logo
}
})
rawData['name'] = rawData['name'] || res['name']
for (const key in customSet) {
if (
Object.prototype.hasOwnProperty.call(customSet, key) &&
![null, undefined].includes(rawData[key])
) {
customSet[key] = rawData[key]
configuredKeys.add(key)
}
}
if (!rawData.theme) {
const { customColor, themeColor } = appearanceStore
const currentColor =
themeColor === 'custom' && customColor
? customColor
: themeColor === 'blue'
? '#3370ff'
: '#1CBA90'
customSet.theme = currentColor || customSet.theme
}
nextTick(() => {
setPageCustomColor(customSet.theme)
})
}
})
onBeforeUnmount(() => {