Sebastion dd9627b682 fix: escape SQL values in row permission filter to prevent injection (CWE-89) ...

All user-controlled values interpolated into SQL WHERE clause fragments
in transTreeItem() and getSysVariableValue() are now passed through
_escape_sql_value() which doubles single quotes (standard SQL escaping)
and escapes backslashes. The logic operator in transTreeToWhere() is
also validated against a whitelist.

Affected injection vectors:
- item["enum_value"] list (enum filter)
- item["value"] string (normal filter)
- user variable values (variable filter)
- current_user name/account/email (system variable filter)
- tree["logic"] operator (tree structure)

2026-06-11 11:21:37 +08:00

..

api

fix: fix Excel sheet name inject SQL

2026-06-08 11:17:02 +08:00

crud

fix: escape SQL values in row permission filter to prevent injection (CWE-89)

2026-06-11 11:21:37 +08:00

embedding

fix: Fix the data source-related issues in the PR

2026-05-11 15:07:15 +08:00

models

fix(Hive): normalize identifier quoting and stabilize metadata/query paths

2026-05-08 11:53:08 +08:00

utils

fix: The system reports an error when uploading an Excel file with null values

2026-04-20 10:17:57 +08:00

__init__.py

feat: datasource api

2025-04-25 18:49:56 +08:00