SQLBot

mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00

Files

T

Sebastion dd9627b682 fix: escape SQL values in row permission filter to prevent injection (CWE-89)

All user-controlled values interpolated into SQL WHERE clause fragments
in transTreeItem() and getSysVariableValue() are now passed through
_escape_sql_value() which doubles single quotes (standard SQL escaping)
and escapes backslashes. The logic operator in transTreeToWhere() is
also validated against a whitelist.

Affected injection vectors:
- item["enum_value"] list (enum filter)
- item["value"] string (normal filter)
- user variable values (variable filter)
- current_user name/account/email (system variable filter)
- tree["logic"] operator (tree structure)

2026-06-11 11:21:37 +08:00

ai_model

feat(Application): Application can configure specified model

2026-04-30 15:23:32 +08:00

chat

fix: improve docs

2026-06-10 11:45:35 +08:00

dashboard

fix(dashboard): Fix the issue where the predicted data cannot be displayed on the data dashboard

2026-04-27 10:53:14 +08:00

data_training

fix: add require_permissions in data training for upload Excel file