Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Release - Fix path traversal bug for sqlite, new clickhouse options, and support for OpenAI-like URLs #329

Merged
merged 41 commits into from
Feb 6, 2025
Merged

Release - Fix path traversal bug for sqlite, new clickhouse options, and support for OpenAI-like URLs #329

merged 41 commits into from
Feb 6, 2025

Conversation

modelorona
Copy link
Collaborator

@modelorona modelorona commented Jan 27, 2025 •
edited by hkdeman
Loading

✨ Improvements

Added new clickhouse options for HTTP

  • Thanks to the contribution by @Slach, we've got additional options for clickhouse support, HTTP protocol, TLS mode, readonly and debug.

Support for OpenAI-like URLs

  • Thanks to the contribution by @learningpro, we support OpenAI-like URLs now. Check the readme to see how to get started!

Support for env variable aliases

Replaced the Monaco Editor with Codemirror

  • Makes the frontend lighter and is completely packaged.

Added loading indicators in several places to provide visual feedback to the user

🐛 Bug Fixes

Path traversal issue for sqlite

  • Resolved an issue with how the database location for sqlite was being parsed resulting in the possibility of path traversal. Thanks to @nnse for catching that one!

Parameter injection issue for MySQL

  • Resolved an issue where it was possible to inject parameters using the UI. Alongside this, we took the time to go through all of the other connectors and check how we're handling input. Please let us know if you find anything out of place! Thanks to @nnse for catching that one!

Unique table IDs for columns with the same name

Tables have correct # index number when paginating

Thank you to everyone who contributed to this release! 🚀
Your feedback and support are invaluable.

apple and others added 20 commits December 2, 2024 21:19
add openai compatible provider
898d894
@learningpro
Merge branch 'clidey:main' into main
b12bc69
@learningpro
Merge branch 'main' into main
15fa9ca
@Slach
add additional options for clickhouse support, HTTP protocol, TLS mod…
95026e8 
…e, readonly and debug advanced options

Signed-off-by: Slach <[email protected]>
@hkdeman
Merge pull request #300 from Slach/main
1411fcf 
add additional options for clickhouse support
@hkdeman
Merge pull request #252 from learningpro/main
b994967 
Add OpenAI Compatible Provider
@modelorona
fix variant A and B for path traversal
27f106b
@modelorona
remove string processing code
cb5b9bf
@modelorona
update directory to end with slash
cfda05a
@modelorona
initial fix for mysql to use the driver Config object to build the ds…
9c15d79 
…n instead of string concat
@modelorona
change to hostPath check to account for length
cb871a0
@modelorona
removed the hostPath for now. removed & from collation before passing…
380544c 
… to config
@modelorona
add back func for reading in params behind isProfile guard
9e8669a
@modelorona
postgres dsn builder surrounds all params with single quotes now to t…
903c223 
…ake value as is
@modelorona
redis addr built using net.JoinHostPort
f2d6de1
@modelorona
modify mongodb to connect using clientOptions
dd94d97
@modelorona
query escape for elasticsearch
520d862
@modelorona
disable clickhouse sslmode as it's not fully complete. update elastic…
33a56d1 
…search to build url using url.URL, further url.QueryEscapes
@modelorona
Update issue templates
3f6fcab
@modelorona
Merge commit from fork
547336a 
fix for sqlite path traversal
github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 27, 2025
View reviewed changes
core/src/plugins/clickhouse/add.go Dismissed Show dismissed Hide dismissed
core/src/plugins/clickhouse/add.go Dismissed Show dismissed Hide dismissed
core/src/plugins/clickhouse/clickhouse.go Dismissed Show dismissed Hide dismissed
core/src/plugins/clickhouse/clickhouse.go Dismissed Show dismissed Hide dismissed
core/src/plugins/clickhouse/delete.go Dismissed Show dismissed Hide dismissed
core/src/plugins/clickhouse/query.go Dismissed Show dismissed Hide dismissed
core/src/plugins/clickhouse/update.go Dismissed Show dismissed Hide dismissed
core/src/plugins/clickhouse/utils.go Dismissed Show dismissed Hide dismissed
@modelorona modelorona changed the title Release - Fix path traversal bug for sqlite and add several clickhouse options Release - Fix path traversal bug for sqlite, new clickhouse options, and support for OpenAI-like URLs Jan 27, 2025
hkdeman and others added 13 commits January 28, 2025 11:47
@hkdeman
feat(frontend): fix up undefined
114522f
@hkdeman
Merge pull request #332 from clidey/hk/issues/scratchpad-wrong-columns
410561a 
Ensure ids are unique for columns with same name
@hkdeman
feat(frontend): replace monaco editor with code mirror for offline pa…
bef215f 
…ckaged use
@hkdeman
feat(editor): fix theming
df37d60
@hkdeman
feat(frontend): fix markdown library issue
e7d8228
@hkdeman
Merge pull request #333 from clidey/hk/issues/switch-to-code-mirror
c27f796 
Replace monaco editor with code mirror
@hkdeman
feat(frontend): add loader and loading states
46a7956
@hkdeman
feat(frontend): add loader and loading states
33c2cd4
@hkdeman
Revert "feat(frontend): add loader and loading states"
e19fe5a 
This reverts commit 46a7956.
@hkdeman
feat(frontend): remove class names logic
35efc89
@hkdeman
Merge pull request #336 from clidey/hk/issues/loading-states
8960083 
Add loading states
@modelorona
add clickhouse table addition operators + label name
d807c72
@hkdeman
feat(frontend): fix table # number and editor default sql and disable…
89fb514 
… logic
@hkdeman hkdeman merged commit d7e8b2a into release Feb 6, 2025
5 checks passed
@hkdeman
Copy link
Contributor

hkdeman commented Feb 6, 2025

🚀 Automatic GitHub Release Creation

Clidey will automatically create a GitHub release based on this Pull Request. 🎉

For more details on how this process works, please refer to the Clidey Documentation.

This comment was generated automatically.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@modelorona @hkdeman @learningpro @Slach