fix: sql injection by FFXN · Pull Request #38295 · langgenius/dify

FFXN · 2026-07-02T06:06:54Z

Important

Make sure you have read our contribution guidelines
Ensure there is an associated issue and you have been assigned to it
Use the correct syntax to link this PR: Fixes #<issue number>.

Summary

Screenshots

Before	After
...	...

Checklist

This change requires a documentation update, included: Dify Document
I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
I've updated the documentation accordingly.
I ran make lint && make type-check (backend) and cd web && pnpm exec vp staged (frontend) to appease the lint gods

…PIs.

…m service including remote template service and database, return responding error message.

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…m service including remote template service and database, return responding error message.

# Conflicts: # api/services/rag_pipeline/pipeline_template/remote/remote_retrieval.py

…he weaviate vector database.

# Conflicts: # api/providers/vdb/vdb-weaviate/src/dify_vdb_weaviate/weaviate_vector.py

# Conflicts: # api/tests/unit_tests/controllers/service_api/dataset/test_hit_testing.py

…e image preview to fail on the chunks details page of the knowledge base.

… is generated for external preview or download only.

github-actions · 2026-07-02T06:09:10Z

Pyrefly Type Coverage

Metric	Base	PR	Delta
Type coverage	51.85%	51.85%	-0.00%
Strict coverage	51.37%	51.37%	-0.00%
Typed symbols	31,521	31,521	0
Untyped symbols	29,542	29,544	+2
Modules	2951	2951	0

codecov · 2026-07-02T06:20:23Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.28%. Comparing base (2429b75) to head (fd0d2f4).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #38295   +/-   ##
=======================================
  Coverage   85.28%   85.28%           
=======================================
  Files        4983     4983           
  Lines      263129   263064   -65     
  Branches    49965    49955   -10     
=======================================
- Hits       224416   224367   -49     
+ Misses      34327    34314   -13     
+ Partials     4386     4383    -3

Flag	Coverage Δ
api	`85.51% <100.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

QuantumGhost · 2026-07-02T06:22:59Z

The code in _search still uses f-string to build dynamic query. Is it possible to migrate those SQL to SQLAlchemy query builder?

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> (cherry picked from commit d9884ef)

FFXN and others added 30 commits March 3, 2026 14:31

fix: Add the validation of doc_form in the Document-related service A…

269bf88

…PIs.

fix: Add the validation of doc_form in the Document-related service A…

08b28b4

…PIs.

Merge remote-tracking branch 'origin/main'

d0bd5b4

Merge remote-tracking branch 'origin/main'

b5e90e7

fix: When can not obtain pipeline template detail failed from upstrea…

1b32e70

…m service including remote template service and database, return responding error message.

Merge branch 'main' into fix/issue-33624

b33d6d1

Apply suggestion from @gemini-code-assist[bot]

6c2decf

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Potential fix for pull request finding

e7cbfb8

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

a6e03c6

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

2f0f97a

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

fix: When can not obtain pipeline template detail failed from upstrea…

b85af2e

…m service including remote template service and database, return responding error message.

Merge remote-tracking branch 'origin/main'

3c27a90

# Conflicts: # api/services/rag_pipeline/pipeline_template/remote/remote_retrieval.py

fix: Querying document list based on hit_count caused slow SQL.

917d362

Merge remote-tracking branch 'origin/main'

e24b6c2

fix: Compatibility issues with the summary index feature when using t…

7fd549f

…he weaviate vector database.

Merge remote-tracking branch 'origin/main'

03660c1

# Conflicts: # api/providers/vdb/vdb-weaviate/src/dify_vdb_weaviate/weaviate_vector.py

Merge remote-tracking branch 'origin/main'

57c1195

fix: hit-testing response failed because of Pydantic check.

e62a67c

Merge remote-tracking branch 'origin/main'

6c5f669

# Conflicts: # api/tests/unit_tests/controllers/service_api/dataset/test_hit_testing.py

fix: Image rendering in the knowledge base failed.

8a23126

Merge branch 'main' into fix/issue-35910

18e2ecd

fix: Image rendering in the knowledge base failed.

9e137e1

Merge remote-tracking branch 'origin/main'

5c31a77

Merge remote-tracking branch 'origin/fix/issue-35910'

36e8677

fix: Using CONSOLE_API_URL to generate an image preview URL causes th…

ea71990

…e image preview to fail on the chunks details page of the knowledge base.

Merge branch 'main' into fix/issue-35910

6c80ee8

fix: Using CONSOLE_API_URL to generate an image preview URL causes th…

d7f99d6

…e image preview to fail on the chunks details page of the knowledge base.

Merge remote-tracking branch 'origin/fix/issue-35910'

6b84383

fix: For core.tools.signature.sign_upload_file function, the file URL…

5e9f419

… is generated for external preview or download only.

Merge remote-tracking branch 'origin/main'

0a3bb67

FFXN added 14 commits June 3, 2026 17:38

Merge remote-tracking branch 'origin/main'

1d65cd0

Merge remote-tracking branch 'origin/main'

d128cac

Merge remote-tracking branch 'origin/main'

4fefee4

Merge remote-tracking branch 'origin/main'

d8ede65

Merge remote-tracking branch 'origin/main'

47d3671

Merge remote-tracking branch 'origin/main'

3e86c60

Merge remote-tracking branch 'origin/main'

338ceab

Merge remote-tracking branch 'origin/main'

9080d15

Merge remote-tracking branch 'origin/main'

903dda9

Merge remote-tracking branch 'origin/main'

ed63b88

Merge remote-tracking branch 'origin/main'

3c90b09

fix: remove redundant snippet permissions from RBAC service

0e304c6

Merge remote-tracking branch 'origin/main'

929bffb

feat: enhance search functionality to use query parameters

fd0d2f4

FFXN requested a review from QuantumGhost as a code owner July 2, 2026 06:06

dosubot Bot added the size:S This PR changes 10-29 lines, ignoring generated files. label Jul 2, 2026

FFXN added this to the 1.16.0 milestone Jul 2, 2026

QuantumGhost approved these changes Jul 2, 2026

View reviewed changes

dosubot Bot added the lgtm This PR has been approved by a maintainer label Jul 2, 2026

crazywoola approved these changes Jul 2, 2026

View reviewed changes

crazywoola added this pull request to the merge queue Jul 2, 2026

Merged via the queue into main with commit d9884ef Jul 2, 2026
36 checks passed

crazywoola deleted the fix/issue-38281-sql-injection branch July 2, 2026 06:38

laipz8200 mentioned this pull request Jul 3, 2026

fix: fix sql injection in mysacale service #38317

Merged

5 tasks

GareArc mentioned this pull request Jul 9, 2026

fix: cherry-pick missing RBAC migration + verified bug fixes onto hotfix/1.15.0-fix.2 #38594

Open

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: sql injection#38295

fix: sql injection#38295
crazywoola merged 59 commits into
mainfrom
fix/issue-38281-sql-injection

FFXN commented Jul 2, 2026

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

codecov Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

QuantumGhost commented Jul 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

FFXN commented Jul 2, 2026

Summary

Screenshots

Checklist

Uh oh!

github-actions Bot commented Jul 2, 2026

Pyrefly Type Coverage

Uh oh!

codecov Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

QuantumGhost commented Jul 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented Jul 2, 2026 •

edited

Loading