ragflow

mirror of https://github.com/infiniflow/ragflow.git synced 2026-01-23 03:26:53 +08:00

Files

Rin bbaf918d74 security: harden OpenDAL SQL initialization against injection (#12393 )

Eliminates SQL injection vectors in the OpenDAL MySQL initialization
logic by implementing strict input validation and explicit type casting.

**Modifications:**
1. **`init_db_config`**: Enforced integer casting for
`max_allowed_packet` before formatting it into the SQL string.
2. **`init_opendal_mysql_table`**: Implemented regex-based validation
for `table_name` to ensure only alphanumeric characters and underscores
are permitted, preventing arbitrary SQL command injection through
configuration parameters.

These changes ensure that even if configuration values are sourced from
untrusted environments, the database initialization remains secure.

2026-01-04 11:19:26 +08:00

app

Refine: image/table context. (#12336 )

2025-12-30 20:24:27 +08:00

flow

Fix: parent-children pipleine bad case. (#12246 )

2025-12-26 18:57:16 +08:00

llm

refactor:re order logics in clean_gen_conf (#12391 )

2026-01-04 10:31:56 +08:00

nlp

Refine: image/table context. (#12336 )