mirror of
https://github.com/Mintplex-Labs/anything-llm
synced 2026-04-26 01:25:15 +02:00
334ce052f0
Replace string concatenation with parameterized queries in all database connectors to prevent SQL injection through LLM-generated table names. Changes: - PostgreSQL: Use $1, $2 placeholders with pg client parameterization - MySQL: Use ? placeholders with mysql2 execute() prepared statements - MSSQL: Use @p0 placeholders with request.input() parameterization - Update handlers to support parameterized query objects - Add formatQueryForDisplay() for logging parameterized queries Security: Mitigates potential SQL injection when LLM passes unsanitized user input as table_name parameter to getTableSchemaSql/getTablesSql. GHSA-jwjx-mw2p-5wc7
76 lines
2.0 KiB
JavaScript
76 lines
2.0 KiB
JavaScript
const pgSql = require("pg");
|
|
|
|
class PostgresSQLConnector {
|
|
#connected = false;
|
|
constructor(
|
|
config = {
|
|
connectionString: null,
|
|
schema: null,
|
|
}
|
|
) {
|
|
this.className = "PostgresSQLConnector";
|
|
this.connectionString = config.connectionString;
|
|
this.schema = config.schema || "public";
|
|
this._client = new pgSql.Client({
|
|
connectionString: this.connectionString,
|
|
});
|
|
}
|
|
|
|
async connect() {
|
|
await this._client.connect();
|
|
this.#connected = true;
|
|
return this._client;
|
|
}
|
|
|
|
/**
|
|
*
|
|
* @param {string} queryString the SQL query to be run
|
|
* @param {Array} params optional parameters for prepared statement
|
|
* @returns {Promise<import(".").QueryResult>}
|
|
*/
|
|
async runQuery(queryString = "", params = []) {
|
|
const result = { rows: [], count: 0, error: null };
|
|
try {
|
|
if (!this.#connected) await this.connect();
|
|
const query = await this._client.query(queryString, params);
|
|
result.rows = query.rows;
|
|
result.count = query.rowCount;
|
|
} catch (err) {
|
|
console.log(this.className, err);
|
|
result.error = err.message;
|
|
} finally {
|
|
// Check client is connected before closing since we use this for validation
|
|
if (this._client) {
|
|
await this._client.end();
|
|
this.#connected = false;
|
|
}
|
|
}
|
|
return result;
|
|
}
|
|
|
|
async validateConnection() {
|
|
try {
|
|
const result = await this.runQuery("SELECT 1");
|
|
return { success: !result.error, error: result.error };
|
|
} catch (error) {
|
|
return { success: false, error: error.message };
|
|
}
|
|
}
|
|
|
|
getTablesSql() {
|
|
return {
|
|
query: `SELECT * FROM pg_catalog.pg_tables WHERE schemaname = $1`,
|
|
params: [this.schema],
|
|
};
|
|
}
|
|
|
|
getTableSchemaSql(table_name) {
|
|
return {
|
|
query: `SELECT column_name, data_type, character_maximum_length, column_default, is_nullable FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name = $1 AND table_schema = $2`,
|
|
params: [table_name, this.schema],
|
|
};
|
|
}
|
|
}
|
|
|
|
module.exports.PostgresSQLConnector = PostgresSQLConnector;
|