5 Commits

Author	SHA1	Message	Date
Timothy Carambat	334ce052f0	Fix SQL injection in SQL Agent plugin via parameterized queries ... Replace string concatenation with parameterized queries in all database connectors to prevent SQL injection through LLM-generated table names. Changes: - PostgreSQL: Use $1, $2 placeholders with pg client parameterization - MySQL: Use ? placeholders with mysql2 execute() prepared statements - MSSQL: Use @p0 placeholders with request.input() parameterization - Update handlers to support parameterized query objects - Add formatQueryForDisplay() for logging parameterized queries Security: Mitigates potential SQL injection when LLM passes unsanitized user input as table_name parameter to getTableSchemaSql/getTablesSql. GHSA-jwjx-mw2p-5wc7	2026-03-12 21:56:57 -07:00
Marcello Fitton	6855bbf695	Refactor Class Name Logging (#4426) ... * Add className property to various LLM and embedder classes to fix logging bug after minification * Fix bug with this.log method by applying the missing private field symbol	2025-09-25 15:34:19 -10:00
Sean Hatfield	49ea545d7f	SQL preflight connection validation (#4150) ... * wip sql connection string validation * handle failed sql connections in frontend * sql preflight connection validation on modal save * revert unneeded be/fe changes * linting, form updates --------- Co-authored-by: timothycarambat <rambat1010@gmail.com>	2025-07-16 09:02:39 -07:00
Timothy Carambat	1c905b1105	Replace connectionString parser for sql-agent (#3560) ... resolves #3551	2025-03-28 12:46:21 -07:00
Timothy Carambat	15cf921616	Support SQL Agent skill (#1411) ... * Support SQL Agent skill * add MSSQL agent connector * Add frontend to agent skills remove FAKE_DB mock reset skills to pickup child-skill dynamically * add prompt examples for tools on untooled * add better logging on SQL agents * Wipe toolruns on each chat relay so tools can be used within the same session * update comments	2024-05-16 10:38:21 -07:00