From 2772cde16e2dbe8951d2343e0bdbbcbee4357219 Mon Sep 17 00:00:00 2001 From: jackieya Date: Thu, 12 Mar 2026 19:16:30 +0800 Subject: [PATCH] security: fix RCE via terminology poisoning and restrict upload access --- backend/apps/db/db.py | 2 +- backend/apps/terminology/api/terminology.py | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/apps/db/db.py b/backend/apps/db/db.py index 4f9904fd..24114a11 100644 --- a/backend/apps/db/db.py +++ b/backend/apps/db/db.py @@ -670,7 +670,7 @@ def check_sql_read(sql: str, ds: CoreDatasource | AssistantOutDsSchema): write_types = ( exp.Insert, exp.Update, exp.Delete, exp.Create, exp.Drop, exp.Alter, - exp.Merge, exp.Command + exp.Merge, exp.Command, exp.Copy ) for stmt in statements: diff --git a/backend/apps/terminology/api/terminology.py b/backend/apps/terminology/api/terminology.py index 7240b278..6911f487 100644 --- a/backend/apps/terminology/api/terminology.py +++ b/backend/apps/terminology/api/terminology.py @@ -164,6 +164,7 @@ session_maker = scoped_session(sessionmaker(bind=engine, class_=Session)) @router.post("/uploadExcel", summary=f"{PLACEHOLDER_PREFIX}upload_term") +@require_permissions(permission=SqlbotPermission(role=['ws_admin'])) @system_log(LogConfig(operation_type=OperationType.IMPORT, module=OperationModules.TERMINOLOGY)) async def upload_excel(trans: Trans, current_user: CurrentUser, file: UploadFile = File(...)): ALLOWED_EXTENSIONS = {"xlsx", "xls"}