klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Fix SQL injection vulnerability

Browse Source
This commit is contained in:
junjun
2026-06-03 12:18:49 +08:00
committed by Junjun
parent d57cf3aee6
commit 76b5176b0e
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/datasource/crud/datasource.py
+9 -8
View File
@@ -328,18 +328,19 @@ def preview(session: SessionDep, current_user: CurrentUser, id: int, data: Table
if fields is None or len(fields) == 0:
return {"fields": [], "data": [], "sql": ''}
table = session.query(CoreTable).filter(CoreTable.id == data.table.id).first()
conf = DatasourceConf(**json.loads(aes_decrypt(ds.configuration))) if ds.type != "excel" else get_engine_config()
sql: str = ""
if ds.type == "mysql" or ds.type == "doris" or ds.type == "starrocks" or ds.type == "hive":
sql = f"""SELECT `{"`, `".join(fields)}` FROM `{data.table.table_name}`
sql = f"""SELECT `{"`, `".join(fields)}` FROM `{table.table_name}`
{where}
LIMIT 100"""
elif ds.type == "sqlServer":
sql = f"""SELECT TOP 100 [{"], [".join(fields)}] FROM [{conf.dbSchema}].[{data.table.table_name}]
sql = f"""SELECT TOP 100 [{"], [".join(fields)}] FROM [{conf.dbSchema}].[{table.table_name}]
{where}
"""
elif ds.type == "pg" or ds.type == "excel" or ds.type == "redshift" or ds.type == "kingbase":
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{conf.dbSchema}"."{data.table.table_name}"
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{conf.dbSchema}"."{table.table_name}"
{where}
LIMIT 100"""
elif ds.type == "oracle":
@@ -348,25 +349,25 @@ def preview(session: SessionDep, current_user: CurrentUser, id: int, data: Table
# ORDER BY "{fields[0]}"
# OFFSET 0 ROWS FETCH NEXT 100 ROWS ONLY"""
sql = f"""SELECT * FROM
(SELECT "{'", "'.join(fields)}" FROM "{conf.dbSchema}"."{data.table.table_name}"
(SELECT "{'", "'.join(fields)}" FROM "{conf.dbSchema}"."{table.table_name}"
{where}
ORDER BY "{fields[0]}")
WHERE ROWNUM <= 100
"""
elif ds.type == "ck":
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{data.table.table_name}"
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{table.table_name}"
{where}
LIMIT 100"""
elif ds.type == "dm":
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{conf.dbSchema}"."{data.table.table_name}"
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{conf.dbSchema}"."{table.table_name}"
{where}
LIMIT 100"""
elif ds.type == "es":
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{data.table.table_name}"
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{table.table_name}"
{where}
LIMIT 100"""
elif ds.type == "sqlite":
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{data.table.table_name}"
sql = f"""SELECT "{'", "'.join(fields)}" FROM "{table.table_name}"
{where}
LIMIT 100"""
return exec_sql(ds, sql, True)