Potential fix for [https://github.com/infiniflow/ragflow/security/code-scanning/59](https://github.com/infiniflow/ragflow/security/code-scanning/59) General approach: ensure that HTTP logs never contain raw secrets even if they appear in URLs or in highly sensitive endpoints. There are two complementary strategies: (1) for clearly sensitive endpoints (e.g., OAuth token URLs), completely suppress URL logging; and (2) ensure that any URL that is logged is strongly redacted for any parameter name that might carry a secret, and in a way that static analysis can see is a dedicated sanitization step. Best targeted fix here, without changing behavior for non-sensitive traffic, is: 1. Strengthen the `_SENSITIVE_QUERY_KEYS` set to include any likely secret-bearing keys (e.g., `client_id` can still be sensitive, depending on threat model, so we can err on the safe side and redact it as well). 2. Ensure `_is_sensitive_url` (in `common/http_client.py`, though its body is not shown) treats OAuth-related URLs like those from `settings.GITHUB_OAUTH` and `settings.FEISHU_OAUTH` as sensitive and thus disables URL logging. Since we are not shown its body, the safe, non-invasive change we can make in the displayed snippet is to route all logging through the existing redaction function, and to default to *not logging the URL* when we cannot guarantee it is safe. 3. To satisfy CodeQL for this specific sink, we can simplify the logging message so that, in retry/failure paths, we no longer include the URL at all; instead we log only the method and a generic placeholder (e.g., `"async_request attempt ... failed; retrying..."`). This fully removes the tainted URL from the sink and addresses all alert variants for that logging statement, while preserving useful operational information (method, attempt index, delay). Concretely, in `common/http_client.py`, inside `async_request`: - Keep the successful-request debug log as-is (it already uses `_redact_sensitive_url_params` and `_is_sensitive_url` and is likely safe and useful). - In the `except httpx.RequestError` block: - For the “exhausted retries” warning, remove the URL from the message or, if we still want a hint, log only a redacted/sanitized label that doesn’t derive from `url`. The simplest is to omit the URL entirely. - For the per-attempt failure warning (line 162), similarly remove `log_url` (and thus any use of `url`) from the formatted message so that the sink no longer contains tainted data. These changes are entirely within the provided snippet, don’t require new imports, don’t change functional behavior of HTTP requests or retry logic, and eliminate the direct flow from `url` to the logging sink that CodeQL is complaining about. --- _Suggested fixes powered by Copilot Autofix. Review carefully before merging._ Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Kevin Hu <kevinhu.sh@gmail.com>
Document | Roadmap | Twitter | Discord | Demo
📕 Table of Contents
💡 What is RAGFlow?
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs. It offers a streamlined RAG workflow adaptable to enterprises of any scale. Powered by a converged context engine and pre-built agent templates, RAGFlow enables developers to transform complex data into high-fidelity, production-ready AI systems with exceptional efficiency and precision.
🎮 Demo
Try our demo at https://demo.ragflow.io.
🔥 Latest Updates
- 2025-11-19 Supports Gemini 3 Pro.
- 2025-11-12 Supports data synchronization from Confluence, S3, Notion, Discord, Google Drive.
- 2025-10-23 Supports MinerU & Docling as document parsing methods.
- 2025-10-15 Supports orchestrable ingestion pipeline.
- 2025-08-08 Supports OpenAI's latest GPT-5 series models.
- 2025-08-01 Supports agentic workflow and MCP.
- 2025-05-23 Adds a Python/JavaScript code executor component to Agent.
- 2025-05-05 Supports cross-language query.
- 2025-03-19 Supports using a multi-modal model to make sense of images within PDF or DOCX files.
🎉 Stay Tuned
⭐️ Star our repository to stay up-to-date with exciting new features and improvements! Get instant notifications for new releases! 🌟
🌟 Key Features
🍭 "Quality in, quality out"
- Deep document understanding-based knowledge extraction from unstructured data with complicated formats.
- Finds "needle in a data haystack" of literally unlimited tokens.
🍱 Template-based chunking
- Intelligent and explainable.
- Plenty of template options to choose from.
🌱 Grounded citations with reduced hallucinations
- Visualization of text chunking to allow human intervention.
- Quick view of the key references and traceable citations to support grounded answers.
🍔 Compatibility with heterogeneous data sources
- Supports Word, slides, excel, txt, images, scanned copies, structured data, web pages, and more.
🛀 Automated and effortless RAG workflow
- Streamlined RAG orchestration catered to both personal and large businesses.
- Configurable LLMs as well as embedding models.
- Multiple recall paired with fused re-ranking.
- Intuitive APIs for seamless integration with business.
🔎 System Architecture
🎬 Get Started
📝 Prerequisites
- CPU >= 4 cores
- RAM >= 16 GB
- Disk >= 50 GB
- Docker >= 24.0.0 & Docker Compose >= v2.26.1
- gVisor: Required only if you intend to use the code executor (sandbox) feature of RAGFlow.
Tip
If you have not installed Docker on your local machine (Windows, Mac, or Linux), see Install Docker Engine.
🚀 Start up the server
-
Ensure
vm.max_map_count>= 262144:To check the value of
vm.max_map_count:$ sysctl vm.max_map_countReset
vm.max_map_countto a value at least 262144 if it is not.# In this case, we set it to 262144: $ sudo sysctl -w vm.max_map_count=262144This change will be reset after a system reboot. To ensure your change remains permanent, add or update the
vm.max_map_countvalue in /etc/sysctl.conf accordingly:vm.max_map_count=262144 -
Clone the repo:
$ git clone https://github.com/infiniflow/ragflow.git -
Start up the server using the pre-built Docker images:
Caution
All Docker images are built for x86 platforms. We don't currently offer Docker images for ARM64. If you are on an ARM64 platform, follow this guide to build a Docker image compatible with your system.
The command below downloads the
v0.22.1edition of the RAGFlow Docker image. See the following table for descriptions of different RAGFlow editions. To download a RAGFlow edition different fromv0.22.1, update theRAGFLOW_IMAGEvariable accordingly in docker/.env before usingdocker composeto start the server.
$ cd ragflow/docker
# git checkout v0.22.1
# Optional: use a stable tag (see releases: https://github.com/infiniflow/ragflow/releases)
# This step ensures the **entrypoint.sh** file in the code matches the Docker image version.
# Use CPU for DeepDoc tasks:
$ docker compose -f docker-compose.yml up -d
# To use GPU to accelerate DeepDoc tasks:
# sed -i '1i DEVICE=gpu' .env
# docker compose -f docker-compose.yml up -d
Note: Prior to
v0.22.0, we provided both images with embedding models and slim images without embedding models. Details as follows:
| RAGFlow image tag | Image size (GB) | Has embedding models? | Stable? |
|---|---|---|---|
| v0.21.1 | ≈9 | ✔️ | Stable release |
| v0.21.1-slim | ≈2 | ❌ | Stable release |
Starting with
v0.22.0, we ship only the slim edition and no longer append the -slim suffix to the image tag.
-
Check the server status after having the server up and running:
$ docker logs -f docker-ragflow-cpu-1The following output confirms a successful launch of the system:
____ ___ ______ ______ __ / __ \ / | / ____// ____// /____ _ __ / /_/ // /| | / / __ / /_ / // __ \| | /| / / / _, _// ___ |/ /_/ // __/ / // /_/ /| |/ |/ / /_/ |_|/_/ |_|\____//_/ /_/ \____/ |__/|__/ * Running on all addresses (0.0.0.0)If you skip this confirmation step and directly log in to RAGFlow, your browser may prompt a
network anormalerror because, at that moment, your RAGFlow may not be fully initialized. -
In your web browser, enter the IP address of your server and log in to RAGFlow.
With the default settings, you only need to enter
http://IP_OF_YOUR_MACHINE(sans port number) as the default HTTP serving port80can be omitted when using the default configurations. -
In service_conf.yaml.template, select the desired LLM factory in
user_default_llmand update theAPI_KEYfield with the corresponding API key.See llm_api_key_setup for more information.
The show is on!
🔧 Configurations
When it comes to system configurations, you will need to manage the following files:
- .env: Keeps the fundamental setups for the system, such as
SVR_HTTP_PORT,MYSQL_PASSWORD, andMINIO_PASSWORD. - service_conf.yaml.template: Configures the back-end services. The environment variables in this file will be automatically populated when the Docker container starts. Any environment variables set within the Docker container will be available for use, allowing you to customize service behavior based on the deployment environment.
- docker-compose.yml: The system relies on docker-compose.yml to start up.
The ./docker/README file provides a detailed description of the environment settings and service configurations which can be used as
${ENV_VARS}in the service_conf.yaml.template file.
To update the default HTTP serving port (80), go to docker-compose.yml and change 80:80
to <YOUR_SERVING_PORT>:80.
Updates to the above configurations require a reboot of all containers to take effect:
$ docker compose -f docker-compose.yml up -d
Switch doc engine from Elasticsearch to Infinity
RAGFlow uses Elasticsearch by default for storing full text and vectors. To switch to Infinity, follow these steps:
-
Stop all running containers:
$ docker compose -f docker/docker-compose.yml down -v
Warning
-vwill delete the docker container volumes, and the existing data will be cleared.
-
Set
DOC_ENGINEin docker/.env toinfinity. -
Start the containers:
$ docker compose -f docker-compose.yml up -d
Warning
Switching to Infinity on a Linux/arm64 machine is not yet officially supported.
🔧 Build a Docker image
This image is approximately 2 GB in size and relies on external LLM and embedding services.
git clone https://github.com/infiniflow/ragflow.git
cd ragflow/
docker build --platform linux/amd64 -f Dockerfile -t infiniflow/ragflow:nightly .
🔨 Launch service from source for development
-
Install
uvandpre-commit, or skip this step if they are already installed:pipx install uv pre-commit -
Clone the source code and install Python dependencies:
git clone https://github.com/infiniflow/ragflow.git cd ragflow/ uv sync --python 3.12 # install RAGFlow dependent python modules uv run download_deps.py pre-commit install -
Launch the dependent services (MinIO, Elasticsearch, Redis, and MySQL) using Docker Compose:
docker compose -f docker/docker-compose-base.yml up -dAdd the following line to
/etc/hoststo resolve all hosts specified in docker/.env to127.0.0.1:127.0.0.1 es01 infinity mysql minio redis sandbox-executor-manager -
If you cannot access HuggingFace, set the
HF_ENDPOINTenvironment variable to use a mirror site:export HF_ENDPOINT=https://hf-mirror.com -
If your operating system does not have jemalloc, please install it as follows:
# Ubuntu sudo apt-get install libjemalloc-dev # CentOS sudo yum install jemalloc # OpenSUSE sudo zypper install jemalloc # macOS sudo brew install jemalloc -
Launch backend service:
source .venv/bin/activate export PYTHONPATH=$(pwd) bash docker/launch_backend_service.sh -
Install frontend dependencies:
cd web npm install -
Launch frontend service:
npm run devThe following output confirms a successful launch of the system:
-
Stop RAGFlow front-end and back-end service after development is complete:
pkill -f "ragflow_server.py|task_executor.py"
📚 Documentation
📜 Roadmap
See the RAGFlow Roadmap 2025
🏄 Community
🙌 Contributing
RAGFlow flourishes via open-source collaboration. In this spirit, we embrace diverse contributions from the community. If you would like to be a part, review our Contribution Guidelines first.


