klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity
2,348 Commits 1 Branch 0 Tags
c4110f6a693a5ce11eb528d54bf9a91ef17556a1
Commit Graph
2348 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
fit2cloud-chenyw c4110f6a69 feat: Add language options to the embed 2026-07-13 14:03:51 +08:00
ulleo c8b5346d54 feat: add system log in mcp_start 2026-07-13 14:03:37 +08:00
ulleo 74a0382c52 feat: add system log in mcp_start 2026-07-13 13:55:00 +08:00
dataeaseShu 8a10be0970 fix(Assistant App): Header text color not working 2026-07-10 17:34:04 +08:00
ulleo d7261dabd6 feat: support configuring terminology for specified advanced applications 2026-07-10 17:22:42 +08:00
dataeaseShu 2c2960e56f fix(Assistant App): Header text color not working 2026-07-10 16:50:25 +08:00
ulleo 487f5fd584 fix: export/import SQL Sample management 2026-07-10 16:12:33 +08:00
ulleo aa594a5681 feat: Adjust the organizational attribution logic of dialogues in MCP 
#1221
 2026-07-09 18:17:03 +08:00
ulleo b947cf2476 feat: add thousands separator settings 2026-07-09 17:45:21 +08:00
ulleo a2196d9c3e fix: fix predict data chart missing problem in record list 2026-07-09 15:55:31 +08:00
dataeaseShu a0f7fb2488 fix(Smart Number Query): When enabling thousands separators, the pop-up window does not close, causing abnormal page scrolling. 2026-07-09 15:11:30 +08:00
dataeaseShu f15c645fa5 fix: Compilation failed 2026-07-07 17:09:26 +08:00
ulleo ce3ea977ae fix: delete chat error when chat title contains '/' character 
#1232
 2026-07-07 15:19:42 +08:00
Fit111 7d4354597c feat: 新增alembic迁移脚本，补充内置数据库表字段备注 2026-07-07 14:18:12 +08:00
maninhill 42888d5ad9 Remove security assessment badge from README 
Removed security assessment badge from README.
 2026-07-07 11:44:33 +08:00
MseeP.ai 11a999d6b6 Add MseeP.ai badge to README.md (#1253) 2026-07-07 11:43:05 +08:00
dataeaseShu 71d1be163e fix(Login): Login page background image logic optimization 2026-07-07 11:12:07 +08:00
dataeaseShu d1d63ac76e fix(User Management): The workspace user list has a pagination limit of 1000 entries, making it impossible to select the 1001st user and beyond. #1243 2026-07-02 10:46:16 +08:00
ulleo 86c4f00940 feat: add system log in mcp_start 
#1241
 2026-07-01 14:04:49 +08:00
dataeaseShu 976feb8ad3 fix(Browser): Styles compatible with older versions of Chromium-based browsers (version 81). 2026-07-01 10:10:33 +08:00
ulleo 275f326742 feat: add hide thinking block configuration 
#1229
 2026-06-30 15:25:24 +08:00
dataeaseShu f73cca98e2 fix(Compile): expand package memory 2026-06-29 16:09:43 +08:00
ulleo 2fc646ce3c feat: Adjust the organizational attribution logic of dialogues in MCP 
#1221
 2026-06-29 16:00:42 +08:00
junjun 4f8d8936c5 feat: Adjust the organizational attribution logic of dialogues in MCP #1221 2026-06-29 15:34:28 +08:00
junjun d41598eea5 feat: Adjust the organizational attribution logic of dialogues in MCP #1221 2026-06-29 15:28:18 +08:00
dataeaseShu 8ad3837083 fix(浏览器): 兼容低版本Chromium 内核浏览器，解决内核81版本页面白屏问题#1226 2026-06-29 14:01:34 +08:00
ulleo 582893ab65 feat: add thousands separator settings 2026-06-24 18:58:19 +08:00
ulleo 65366d0a41 pref: improve show label button in chart display 2026-06-24 18:02:53 +08:00
ulleo a3b45754a3 feat: add thousands separator settings 2026-06-24 17:45:33 +08:00
fit2cloud-chenyw dc2b0788f4 perf: Add API documentation toggle control 2026-06-24 09:59:39 +08:00
junjun 936bb5d390 fix: Compatible with older versions of MSSQL in DataEase 2026-06-23 14:57:10 +08:00
ulleo b1a425af5e feat: remove default title in index.html 2026-06-22 17:18:02 +08:00
ulleo 92d55a8ae4 chron: format line 2026-06-22 14:30:29 +08:00
junjun 1c8b6f95ae fix: Fix the vulnerability in viewing enumeration values across workspaces 2026-06-17 17:56:41 +08:00
junjun df44e660bd fix: Fix the vulnerability in viewing enumeration values across workspaces 2026-06-17 17:13:50 +08:00
ulleo a76f8e7f9b fix: correct database query examples in templates 2026-06-17 16:37:24 +08:00
ulleo 4af99e0c45 feat: support configuring terminology for specified advanced applications 2026-06-16 17:23:50 +08:00
junjun 447592b767 fix: Fix MCP oid missing validation 2026-06-11 17:51:37 +08:00
junjun cc45f47c12 fix: Fix MCP oid missing validation 2026-06-11 17:33:42 +08:00
ulleo 5b94406c3a fix: Fix SQL injection / LLM Prompt Injection vulnerability causing unauthorized queries 
Security hardening:
- Add SQLBOT_ALLOW_METADATA_QUERIES config option, disable SHOW/DESCRIBE/EXPLAIN by default
- Add table whitelist check, use sqlglot to parse actual SQL table names and compare with authorized table list
- Add dangerous function check, block LOAD_FILE, INTO OUTFILE, EXEC etc. by database type
- Improve check_sql_read to return specific error reasons for better debugging
 2026-06-11 17:29:38 +08:00
Sebastion 82b1028305 test: add unit tests for CWE-89 SQL escape fix in row_permission.py 2026-06-11 11:21:37 +08:00
Sebastion dd9627b682 fix: escape SQL values in row permission filter to prevent injection (CWE-89) 
All user-controlled values interpolated into SQL WHERE clause fragments
in transTreeItem() and getSysVariableValue() are now passed through
_escape_sql_value() which doubles single quotes (standard SQL escaping)
and escapes backslashes. The logic operator in transTreeToWhere() is
also validated against a whitelist.

Affected injection vectors:
- item["enum_value"] list (enum filter)
- item["value"] string (normal filter)
- user variable values (variable filter)
- current_user name/account/email (system variable filter)
- tree["logic"] operator (tree structure)
 2026-06-11 11:21:37 +08:00
ulleo b472bc0977 fix: improve docs 
#1183
 2026-06-10 11:45:35 +08:00
wangjiahao 2da3ae4111 fix: Extend sys_logs user_agent column length to support DingTalk agent (#1170) 
The DingTalk agent sends user_agent strings that exceed the previous
255-character limit, causing log entries to be silently dropped.
Increase the column to VARCHAR(500).
 2026-06-09 14:44:38 +08:00
junjun 7637ab391d fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 17:01:44 +08:00
junjun ba7b397c51 fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 16:54:17 +08:00
dataeaseShu 980ab61e62 fix: Style optimization 2026-06-08 16:38:42 +08:00
junjun 81c8acda91 fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 16:33:34 +08:00
ulleo 316450b027 feat: improve float value display in export excel 2026-06-08 16:20:21 +08:00
junjun 80dc9a3aa8 fix: Fix the privilege escalation vulnerability in system variables 2026-06-08 15:26:55 +08:00