mirror of
https://github.com/Mintplex-Labs/anything-llm
synced 2026-04-26 01:25:15 +02:00
Replace string concatenation with parameterized queries in all database connectors to prevent SQL injection through LLM-generated table names. Changes: - PostgreSQL: Use $1, $2 placeholders with pg client parameterization - MySQL: Use ? placeholders with mysql2 execute() prepared statements - MSSQL: Use @p0 placeholders with request.input() parameterization - Update handlers to support parameterized query objects - Add formatQueryForDisplay() for logging parameterized queries Security: Mitigates potential SQL injection when LLM passes unsanitized user input as table_name parameter to getTableSchemaSql/getTablesSql. GHSA-jwjx-mw2p-5wc7
84 lines
2.3 KiB
JavaScript
84 lines
2.3 KiB
JavaScript
const mysql = require("mysql2/promise");
|
|
const { ConnectionStringParser } = require("./utils");
|
|
|
|
class MySQLConnector {
|
|
#connected = false;
|
|
database_id = "";
|
|
constructor(
|
|
config = {
|
|
connectionString: null,
|
|
}
|
|
) {
|
|
this.className = "MySQLConnector";
|
|
this.connectionString = config.connectionString;
|
|
this._client = null;
|
|
this.database_id = this.#parseDatabase();
|
|
}
|
|
|
|
#parseDatabase() {
|
|
const connectionParser = new ConnectionStringParser({ scheme: "mysql" });
|
|
const parsed = connectionParser.parse(this.connectionString);
|
|
return parsed?.endpoint;
|
|
}
|
|
|
|
async connect() {
|
|
this._client = await mysql.createConnection({ uri: this.connectionString });
|
|
this.#connected = true;
|
|
return this._client;
|
|
}
|
|
|
|
/**
|
|
*
|
|
* @param {string} queryString the SQL query to be run
|
|
* @param {Array} params optional parameters for prepared statement
|
|
* @returns {Promise<import(".").QueryResult>}
|
|
*/
|
|
async runQuery(queryString = "", params = []) {
|
|
const result = { rows: [], count: 0, error: null };
|
|
try {
|
|
if (!this.#connected) await this.connect();
|
|
const [query] =
|
|
params.length > 0
|
|
? await this._client.execute(queryString, params)
|
|
: await this._client.query(queryString);
|
|
result.rows = query;
|
|
result.count = query?.length;
|
|
} catch (err) {
|
|
console.log(this.className, err);
|
|
result.error = err.message;
|
|
} finally {
|
|
// Check client is connected before closing since we use this for validation
|
|
if (this._client) {
|
|
await this._client.end();
|
|
this.#connected = false;
|
|
}
|
|
}
|
|
return result;
|
|
}
|
|
|
|
async validateConnection() {
|
|
try {
|
|
const result = await this.runQuery("SELECT 1");
|
|
return { success: !result.error, error: result.error };
|
|
} catch (error) {
|
|
return { success: false, error: error.message };
|
|
}
|
|
}
|
|
|
|
getTablesSql() {
|
|
return {
|
|
query: `SELECT table_name FROM information_schema.tables WHERE table_schema = ?`,
|
|
params: [this.database_id],
|
|
};
|
|
}
|
|
|
|
getTableSchemaSql(table_name) {
|
|
return {
|
|
query: `SELECT COLUMN_NAME, COLUMN_TYPE, IS_NULLABLE, COLUMN_KEY, COLUMN_DEFAULT, EXTRA FROM information_schema.columns WHERE table_schema = ? AND table_name = ?`,
|
|
params: [this.database_id, table_name],
|
|
};
|
|
}
|
|
}
|
|
|
|
module.exports.MySQLConnector = MySQLConnector;
|