klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity
2,321 Commits 1 Branch 0 Tags
65366d0a41fbd1fe613c9ae400cf7e136ed46b80
Commit Graph
2321 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ulleo 65366d0a41 pref: improve show label button in chart display 2026-06-24 18:02:53 +08:00
ulleo a3b45754a3 feat: add thousands separator settings 2026-06-24 17:45:33 +08:00
fit2cloud-chenyw dc2b0788f4 perf: Add API documentation toggle control 2026-06-24 09:59:39 +08:00
junjun 936bb5d390 fix: Compatible with older versions of MSSQL in DataEase 2026-06-23 14:57:10 +08:00
ulleo b1a425af5e feat: remove default title in index.html 2026-06-22 17:18:02 +08:00
ulleo 92d55a8ae4 chron: format line 2026-06-22 14:30:29 +08:00
junjun 1c8b6f95ae fix: Fix the vulnerability in viewing enumeration values across workspaces 2026-06-17 17:56:41 +08:00
junjun df44e660bd fix: Fix the vulnerability in viewing enumeration values across workspaces 2026-06-17 17:13:50 +08:00
ulleo a76f8e7f9b fix: correct database query examples in templates 2026-06-17 16:37:24 +08:00
ulleo 4af99e0c45 feat: support configuring terminology for specified advanced applications 2026-06-16 17:23:50 +08:00
junjun 447592b767 fix: Fix MCP oid missing validation 2026-06-11 17:51:37 +08:00
junjun cc45f47c12 fix: Fix MCP oid missing validation 2026-06-11 17:33:42 +08:00
ulleo 5b94406c3a fix: Fix SQL injection / LLM Prompt Injection vulnerability causing unauthorized queries 
Security hardening:
- Add SQLBOT_ALLOW_METADATA_QUERIES config option, disable SHOW/DESCRIBE/EXPLAIN by default
- Add table whitelist check, use sqlglot to parse actual SQL table names and compare with authorized table list
- Add dangerous function check, block LOAD_FILE, INTO OUTFILE, EXEC etc. by database type
- Improve check_sql_read to return specific error reasons for better debugging
 2026-06-11 17:29:38 +08:00
Sebastion 82b1028305 test: add unit tests for CWE-89 SQL escape fix in row_permission.py 2026-06-11 11:21:37 +08:00
Sebastion dd9627b682 fix: escape SQL values in row permission filter to prevent injection (CWE-89) 
All user-controlled values interpolated into SQL WHERE clause fragments
in transTreeItem() and getSysVariableValue() are now passed through
_escape_sql_value() which doubles single quotes (standard SQL escaping)
and escapes backslashes. The logic operator in transTreeToWhere() is
also validated against a whitelist.

Affected injection vectors:
- item["enum_value"] list (enum filter)
- item["value"] string (normal filter)
- user variable values (variable filter)
- current_user name/account/email (system variable filter)
- tree["logic"] operator (tree structure)
 2026-06-11 11:21:37 +08:00
ulleo b472bc0977 fix: improve docs 
#1183
 2026-06-10 11:45:35 +08:00
wangjiahao 2da3ae4111 fix: Extend sys_logs user_agent column length to support DingTalk agent (#1170) 
The DingTalk agent sends user_agent strings that exceed the previous
255-character limit, causing log entries to be silently dropped.
Increase the column to VARCHAR(500).
 2026-06-09 14:44:38 +08:00
junjun 7637ab391d fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 17:01:44 +08:00
junjun ba7b397c51 fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 16:54:17 +08:00
dataeaseShu 980ab61e62 fix: Style optimization 2026-06-08 16:38:42 +08:00
junjun 81c8acda91 fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 16:33:34 +08:00
ulleo 316450b027 feat: improve float value display in export excel 2026-06-08 16:20:21 +08:00
junjun 80dc9a3aa8 fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 15:26:55 +08:00
junjun 5d5a92a526 fix: fix Excel sheet name inject SQL 2026-06-08 11:17:02 +08:00
ulleo 2e4f3bf98c feat: Add parameter configuration to hide show SQL button & hide execute log in chat 2026-06-05 17:27:00 +08:00
dataeaseShu 6fecd7dff8 feat(workspace): authorized workspace model UI 2026-06-05 10:42:25 +08:00
junjun 0c4f0c72c4 fix: Fix the issue where obtaining schema from DM data source may require a high privilege account 2026-06-05 09:58:37 +08:00
xuwei-fit2cloud a502113155 Update version to v1.9.0 2026-06-04 18:22:30 +08:00
octo-patch b86b70d396 feat: upgrade MiniMax default model to M3 
- Add MiniMax-M3 as the new default model
- Retain MiniMax-M2.7 as available alternative
- Remove deprecated MiniMax-M2.5 and MiniMax-M2.5-highspeed
- Update unit and integration tests for the new model list
 2026-06-04 17:11:00 +08:00
dataeaseShu f54a7cc7d5 feat(workspace): authorized workspace model UI 2026-06-04 16:51:01 +08:00
junjun 98dba5f517 fix: Fix the privilege escalation vulnerability in system variables 2026-06-04 16:42:48 +08:00
ulleo d5d5e87b51 feat(Application): Application can configure specified model 2026-06-04 15:06:09 +08:00
ulleo c53ac8f720 feat(Model Configuration): Supported Authorized Space 2026-06-04 14:38:00 +08:00
ulleo 9b72922949 feat(Table): remove header when copying data with Ctrl+C 2026-06-04 14:10:34 +08:00
junjun bd5605b681 fix: remove sqlite datasource 2026-06-04 11:40:58 +08:00
junjun 348346d97b fix: remove sqlite datasource 2026-06-04 11:40:31 +08:00
junjun bcd758d029 fix: remove sqlite datasource 2026-06-04 11:33:18 +08:00
ulleo 3f3dc08a67 feat(Model Configuration): Supported Authorized Space 2026-06-04 10:49:30 +08:00
dataeaseShu 2e1b6fb37f fix: Style optimization 2026-06-04 10:20:05 +08:00
ulleo f691b3e03a feat(Application): Application can configure specified model 2026-06-03 17:29:09 +08:00
xuwei-fit2cloud c0802dbadc Update contact QR code in README 2026-06-03 16:22:02 +08:00
dataeaseShu db6cfc2139 feat(Model Configuration): Supported Authorized Space 2026-06-03 16:03:26 +08:00
ulleo 835eefcb39 fix: remove svg image support in upload files 2026-06-03 15:55:05 +08:00
dataeaseShu 49e7bb1245 fix: Style optimization 2026-06-03 15:54:36 +08:00
dataeaseShu b950664978 feat(Model Configuration): Supported Authorized Space 2026-06-03 15:46:58 +08:00
junjun 76b5176b0e fix: Fix SQL injection vulnerability 2026-06-03 12:18:49 +08:00
ulleo d57cf3aee6 feat(Application): Application can configure specified model 2026-06-02 16:59:24 +08:00
ulleo 23ca654bc4 feat(Application): Application can configure specified model 2026-06-02 16:24:44 +08:00
dataeaseShu a6ca7af2e9 feat(Model Configuration): Supported Authorized Space 2026-06-02 15:20:31 +08:00
dataeaseShu 4a9f4e2187 feat(Model Configuration): Supported Authorized Space 2026-06-02 15:15:36 +08:00