klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Fix SSRF causing arbitrary file read vulnerability

Browse Source
This commit is contained in:
junjun
2026-03-13 18:21:24 +08:00
committed by Junjun
parent beeddb64c6
commit bb30a3a545
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/db/db.py
+4 -3
View File
@@ -688,6 +688,7 @@ def check_sql_read(sql: str, ds: CoreDatasource | AssistantOutDsSchema):
def checkParams(extraParams: str, illegalParams: List[str]):
kvs = extraParams.split('&')
for kv in kvs:
k, v = kv.split('=')
if k in illegalParams:
raise HTTPException(status_code=500, detail=f'Illegal Parameter: {k}')
if kv and '=' in kv:
k, v = kv.split('=')
if k in illegalParams:
raise HTTPException(status_code=500, detail=f'Illegal Parameter: {k}')