github/sim
1
0
Fork 0
mirror of https://github.com/simstudioai/sim.git synced 2026-01-09 15:07:55 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(dbs): remove harness from validation on user-provided db creds (#2308)

Browse Source
This commit is contained in:
Waleed
2025-12-11 00:25:48 -08:00
committed by GitHub
parent 0997989f36
commit 207a14970b
5 changed files with 1 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
apps/sim/app/api/tools/mysql/utils.ts
View File

@@ -19,7 +19,6 @@ export async function createMySQLConnection(config: MySQLConnectionConfig) {
}
if (config.ssl === 'disabled') {
// Don't set ssl property at all to disable SSL
} else if (config.ssl === 'required') {
connectionConfig.ssl = { rejectUnauthorized: true }
} else if (config.ssl === 'preferred') {
@@ -54,42 +53,6 @@ export async function executeQuery(
export function validateQuery(query: string): { isValid: boolean; error?: string } {
const trimmedQuery = query.trim().toLowerCase()
const dangerousPatterns = [
/drop\s+database/i,
/drop\s+schema/i,
/drop\s+user/i,
/create\s+user/i,
/grant\s+/i,
/revoke\s+/i,
/alter\s+user/i,
/set\s+global/i,
/set\s+session/i,
/load\s+data/i,
/into\s+outfile/i,
/into\s+dumpfile/i,
/load_file\s*\(/i,
/system\s+/i,
/exec\s+/i,
/execute\s+immediate/i,
/xp_cmdshell/i,
/sp_configure/i,
/information_schema\.tables/i,
/mysql\.user/i,
/mysql\.db/i,
/mysql\.host/i,
/performance_schema/i,
/sys\./i,
]
for (const pattern of dangerousPatterns) {
if (pattern.test(query)) {
return {
isValid: false,
error: `Query contains potentially dangerous operation: ${pattern.source}`,
}
}
}
const allowedStatements = /^(select|insert|update|delete|with|show|describe|explain)\s+/i
if (!allowedStatements.test(trimmedQuery)) {
return {

32
apps/sim/app/api/tools/neo4j/utils.ts
View File

@@ -30,10 +30,7 @@ export async function createNeo4jDriver(config: Neo4jConnectionConfig) {
return driver
}
export function validateCypherQuery(
query: string,
allowDangerousOps = false
): { isValid: boolean; error?: string } {
export function validateCypherQuery(query: string): { isValid: boolean; error?: string } {
if (!query || typeof query !== 'string') {
return {
isValid: false,
@@ -41,33 +38,6 @@ export function validateCypherQuery(
}
}
if (!allowDangerousOps) {
const dangerousPatterns = [
/DROP\s+DATABASE/i,
/DROP\s+CONSTRAINT/i,
/DROP\s+INDEX/i,
/CREATE\s+DATABASE/i,
/CREATE\s+CONSTRAINT/i,
/CREATE\s+INDEX/i,
/CALL\s+dbms\./i,
/CALL\s+db\./i,
/LOAD\s+CSV/i,
/apoc\.cypher\.run/i,
/apoc\.load/i,
/apoc\.periodic/i,
]
for (const pattern of dangerousPatterns) {
if (pattern.test(query)) {
return {
isValid: false,
error:
'Query contains potentially dangerous operations (schema changes, system procedures, or external data loading)',
}
}
}
}
const trimmedQuery = query.trim()
if (trimmedQuery.length === 0) {
return {

40
apps/sim/app/api/tools/postgresql/utils.ts
View File

@@ -42,46 +42,6 @@ export async function executeQuery(
export function validateQuery(query: string): { isValid: boolean; error?: string } {
const trimmedQuery = query.trim().toLowerCase()
// Block dangerous SQL operations
const dangerousPatterns = [
/drop\s+database/i,
/drop\s+schema/i,
/drop\s+user/i,
/create\s+user/i,
/create\s+role/i,
/grant\s+/i,
/revoke\s+/i,
/alter\s+user/i,
/alter\s+role/i,
/set\s+role/i,
/reset\s+role/i,
/copy\s+.*from/i,
/copy\s+.*to/i,
/lo_import/i,
/lo_export/i,
/pg_read_file/i,
/pg_write_file/i,
/pg_ls_dir/i,
/information_schema\.tables/i,
/pg_catalog/i,
/pg_user/i,
/pg_shadow/i,
/pg_roles/i,
/pg_authid/i,
/pg_stat_activity/i,
/dblink/i,
/\\\\copy/i,
]
for (const pattern of dangerousPatterns) {
if (pattern.test(query)) {
return {
isValid: false,
error: `Query contains potentially dangerous operation: ${pattern.source}`,
}
}
}
const allowedStatements = /^(select|insert|update|delete|with|explain|analyze|show)\s+/i
if (!allowedStatements.test(trimmedQuery)) {
return {

1
apps/sim/app/api/tools/rds/query/route.ts
View File

@@ -25,7 +25,6 @@ export async function POST(request: NextRequest) {
logger.info(`[${requestId}] Executing RDS query on ${params.database}`)
// Validate the query
const validation = validateQuery(params.query)
if (!validation.isValid) {
logger.warn(`[${requestId}] Query validation failed: ${validation.error}`)

23
apps/sim/app/api/tools/rds/utils.ts
View File

@@ -82,29 +82,6 @@ function parseFieldValue(field: Field): unknown {
export function validateQuery(query: string): { isValid: boolean; error?: string } {
const trimmedQuery = query.trim().toLowerCase()
const dangerousPatterns = [
/drop\s+database/i,
/drop\s+schema/i,
/drop\s+user/i,
/create\s+user/i,
/create\s+role/i,
/grant\s+/i,
/revoke\s+/i,
/alter\s+user/i,
/alter\s+role/i,
/set\s+role/i,
/reset\s+role/i,
]
for (const pattern of dangerousPatterns) {
if (pattern.test(query)) {
return {
isValid: false,
error: `Query contains potentially dangerous operation: ${pattern.source}`,
}
}
}
const allowedStatements = /^(select|insert|update|delete|with|explain|show)\s+/i
if (!allowedStatements.test(trimmedQuery)) {
return {