ragflow

mirror of https://github.com/infiniflow/ragflow.git synced 2026-06-30 07:51:10 +08:00

Files

orbisai0security e992fe39b2 fix: the oceanbase database connector constructs sql... in ob_conn.py (#14470 )

## Summary
Fix critical severity security issue in `rag/utils/ob_conn.py`.

## Vulnerability
| Field | Value |
|-------|-------|
| **ID** | V-003 |
| **Severity** | CRITICAL |
| **Scanner** | multi_agent_ai |
| **Rule** | `V-003` |
| **File** | `rag/utils/ob_conn.py:691` |

**Description**: The OceanBase database connector constructs SQL WHERE
clauses by directly embedding user-controlled filter expressions using
Python f-strings at lines 726, 777, 781, 787, 793, 821, and 827. No
parameterization or allowlist validation is applied before the
expressions are incorporated into live SQL queries. This is the most
critical vulnerability in the codebase because it directly exposes the
RAG knowledge base — the platform's core business asset — to complete
compromise.

## Changes
- `rag/utils/ob_conn.py`

## Verification
- [x] Build passes
- [x] Scanner re-scan confirms fix
- [x] LLM code review passed

---
*Automated security fix by [OrbisAI Security](https://orbisappsec.com)*

2026-04-30 14:25:17 +08:00

__init__.py

Move token related functions to common (#10942 )

2025-11-03 08:50:05 +08:00

azure_sas_conn.py

fix azure blob put method param (#14329 )

2026-04-23 20:40:54 +08:00

azure_spn_conn.py

fix azure blob put method param (#14329 )

2026-04-23 20:40:54 +08:00

base64_image.py

Fix: close detached PIL image on JPEG save failure in encode_image (#13278 )