ulleo 5b94406c3a fix: Fix SQL injection / LLM Prompt Injection vulnerability causing unauthorized queries ...

Security hardening:
- Add SQLBOT_ALLOW_METADATA_QUERIES config option, disable SHOW/DESCRIBE/EXPLAIN by default
- Add table whitelist check, use sqlglot to parse actual SQL table names and compare with authorized table list
- Add dangerous function check, block LOAD_FILE, INTO OUTFILE, EXEC etc. by database type
- Improve check_sql_read to return specific error reasons for better debugging

2026-06-11 17:29:38 +08:00

..

__init__.py

feat: Login api

2025-04-23 21:14:42 +08:00

config.py

fix: Fix SQL injection / LLM Prompt Injection vulnerability causing unauthorized queries

2026-06-11 17:29:38 +08:00

db.py

perf: Global Transaction Mechanism

2025-12-24 11:52:14 +08:00

deps.py

perf: Assistant switch online

2025-07-27 00:56:07 +08:00

file.py

feat: import Sample SQL

2025-11-17 20:17:15 +08:00

models.py

feat: AI Model

2025-05-07 16:21:17 +08:00

pagination.py

perf: Optimize Formatted Pagination Query Results

2025-08-21 14:12:45 +08:00

response_middleware.py

perf: Optimize frontend localStorage key conflicts

2026-04-14 12:04:13 +08:00

schemas.py

feat: API documentation for user and workspace (#615)

2025-12-12 16:18:02 +08:00

security_config.py

refactor: Code security optimization

2025-12-26 16:38:47 +08:00

security.py

perf: User api

2025-07-07 11:17:22 +08:00

sqlbot_cache.py

refactor: Code security optimization

2025-12-26 16:38:47 +08:00