klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity
2,316 Commits 1 Branch 0 Tags
92d55a8ae4af48758db9fab30633e814ff64efea
Commit Graph
1005 Commits
Author SHA1 Message Date
ulleo 92d55a8ae4 chron: format line 2026-06-22 14:30:29 +08:00
junjun 1c8b6f95ae fix: Fix the vulnerability in viewing enumeration values across workspaces 2026-06-17 17:56:41 +08:00
junjun df44e660bd fix: Fix the vulnerability in viewing enumeration values across workspaces 2026-06-17 17:13:50 +08:00
ulleo a76f8e7f9b fix: correct database query examples in templates 2026-06-17 16:37:24 +08:00
ulleo 4af99e0c45 feat: support configuring terminology for specified advanced applications 2026-06-16 17:23:50 +08:00
junjun 447592b767 fix: Fix MCP oid missing validation 2026-06-11 17:51:37 +08:00
junjun cc45f47c12 fix: Fix MCP oid missing validation 2026-06-11 17:33:42 +08:00
ulleo 5b94406c3a fix: Fix SQL injection / LLM Prompt Injection vulnerability causing unauthorized queries 
Security hardening:
- Add SQLBOT_ALLOW_METADATA_QUERIES config option, disable SHOW/DESCRIBE/EXPLAIN by default
- Add table whitelist check, use sqlglot to parse actual SQL table names and compare with authorized table list
- Add dangerous function check, block LOAD_FILE, INTO OUTFILE, EXEC etc. by database type
- Improve check_sql_read to return specific error reasons for better debugging
 2026-06-11 17:29:38 +08:00
Sebastion dd9627b682 fix: escape SQL values in row permission filter to prevent injection (CWE-89) 
All user-controlled values interpolated into SQL WHERE clause fragments
in transTreeItem() and getSysVariableValue() are now passed through
_escape_sql_value() which doubles single quotes (standard SQL escaping)
and escapes backslashes. The logic operator in transTreeToWhere() is
also validated against a whitelist.

Affected injection vectors:
- item["enum_value"] list (enum filter)
- item["value"] string (normal filter)
- user variable values (variable filter)
- current_user name/account/email (system variable filter)
- tree["logic"] operator (tree structure)
 2026-06-11 11:21:37 +08:00
ulleo b472bc0977 fix: improve docs 
#1183
 2026-06-10 11:45:35 +08:00
wangjiahao 2da3ae4111 fix: Extend sys_logs user_agent column length to support DingTalk agent (#1170) 
The DingTalk agent sends user_agent strings that exceed the previous
255-character limit, causing log entries to be silently dropped.
Increase the column to VARCHAR(500).
 2026-06-09 14:44:38 +08:00
junjun 7637ab391d fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 17:01:44 +08:00
junjun ba7b397c51 fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 16:54:17 +08:00
junjun 81c8acda91 fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 16:33:34 +08:00
ulleo 316450b027 feat: improve float value display in export excel 2026-06-08 16:20:21 +08:00
junjun 80dc9a3aa8 fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 15:26:55 +08:00
junjun 5d5a92a526 fix: fix Excel sheet name inject SQL 2026-06-08 11:17:02 +08:00
junjun 0c4f0c72c4 fix: Fix the issue where obtaining schema from DM data source may require a high privilege account 2026-06-05 09:58:37 +08:00
xuwei-fit2cloud a502113155 Update version to v1.9.0 2026-06-04 18:22:30 +08:00
junjun 98dba5f517 fix: Fix the privilege escalation vulnerability in system variables 2026-06-04 16:42:48 +08:00
ulleo d5d5e87b51 feat(Application): Application can configure specified model 2026-06-04 15:06:09 +08:00
ulleo c53ac8f720 feat(Model Configuration): Supported Authorized Space 2026-06-04 14:38:00 +08:00
junjun bd5605b681 fix: remove sqlite datasource 2026-06-04 11:40:58 +08:00
junjun 348346d97b fix: remove sqlite datasource 2026-06-04 11:40:31 +08:00
ulleo 3f3dc08a67 feat(Model Configuration): Supported Authorized Space 2026-06-04 10:49:30 +08:00
ulleo f691b3e03a feat(Application): Application can configure specified model 2026-06-03 17:29:09 +08:00
ulleo 835eefcb39 fix: remove svg image support in upload files 2026-06-03 15:55:05 +08:00
junjun 76b5176b0e fix: Fix SQL injection vulnerability 2026-06-03 12:18:49 +08:00
ulleo d57cf3aee6 feat(Application): Application can configure specified model 2026-06-02 16:59:24 +08:00
ulleo 23ca654bc4 feat(Application): Application can configure specified model 2026-06-02 16:24:44 +08:00
ulleo 4b0d4ce663 feat(Application): Application can configure specified model 2026-06-02 14:46:55 +08:00
ulleo 46de2322b0 feat(Application): Application can configure specified model 2026-06-02 14:18:35 +08:00
ulleo 74fe71dd0a feat(Application): Application can configure specified model 2026-06-02 14:08:47 +08:00
ulleo ba16432a66 feat(Application): Application can configure specified model 2026-06-02 14:05:52 +08:00
junjun 4bfd0f49e8 fix: Fix parseExcel vulnerability 2026-06-01 12:30:51 +08:00
junjun 92c5aea70b fix: Fix parseExcel vulnerability 2026-06-01 12:28:20 +08:00
ulleo fb388b5128 chron: update import 2026-05-22 17:25:56 +08:00
fit2cloud-chenyw a26b173165 fix(X-Pack): Unable to save model due to long API Key #1090 2026-05-22 11:57:02 +08:00
ulleo 46400d0ad0 fix: add require_permissions in data training for upload Excel file 2026-05-12 16:48:46 +08:00
ulleo e72c0bedda fix: Fix the data source-related issues in the PR 2026-05-11 15:07:15 +08:00
ulleo afbb3d7981 feat: Support configure SQLBot name in chat template 2026-05-08 17:11:16 +08:00
junjun d12f3609b5 fix: Fix the data source-related issues in the PR 2026-05-08 16:32:22 +08:00
junjun 33c6b7b944 fix: Fix the data source-related issues in the PR 2026-05-08 16:26:28 +08:00
junjun 37b4eb65eb fix: Fix the data source-related issues in the PR 2026-05-08 12:45:11 +08:00
yym 1cf4f249ed feat/fix(charts): Normalize qualified SQL column names for display 
- Add DataFormat.normalize_qualified_sql_column_keys* so driver keys like
  "_u2.table_name" also expose "table_name", matching chart columns[].value.
- Apply after SQL execution (LLM save path), format_json_list_data (API/history),
  and get_chart_data_ds (live refresh).

Hive prompts: Document explicit table aliases for duplicate column names in JOINs.

Frontend: Add datasource form i18n key "file_path" (en/zh-CN/zh-TW/ko-KR).
Update Hive/SQLite datasource icons. Remove hive from haveSchema list.
 2026-05-08 11:53:08 +08:00
yym eb587fce7b fix(Hive): normalize identifier quoting and stabilize metadata/query paths 
Use Hive-compatible identifier handling and template defaults so generated SQL returns real column values, while also fixing table schema parsing and adding required Hive runtime dependencies.

Made-with: Cursor
 2026-05-08 11:53:08 +08:00
yymandClaude Opus 4.6 348fd3850f feat: Add SQLite and Hive database support with sample data for AI 
- Add SQLite support to data sources (file-based connection)
- Add Hive support to data sources
- Add SSL toggle option for MySQL and Doris databases
- Add sample data (3 rows JSON format) to help AI better understand table schema
- Fix SQLite schema table name issue (empty schema prefix)
- Add SQLite.yaml template for SQL generation
- Add Hive to haveSchema list in frontend

Co-Authored-By: Claude Opus 4.6 <[email protected]>
 2026-05-08 11:53:08 +08:00
ulleo 387731236e feat(Application): Application can configure specified model 2026-04-30 15:23:32 +08:00
junjun b2de038e7a fix: Privilege Escalation Vulnerability 2026-04-30 09:49:24 +08:00
junjun a1fbb05795 fix: The remarks of the DM datasource fields cannot be synchronized #1079 2026-04-29 10:12:06 +08:00