AI/dify
1
0
Fork 0
mirror of https://git.mirrors.martin98.com/https://github.com/langgenius/dify.git synced 2025-06-30 06:45:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix vector db sql injection (#16096)

Browse Source
This commit is contained in:
Jyong 2025-03-18 15:07:29 +08:00 committed by GitHub
parent 750ec55646
commit 33ba7e659b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
api/core/rag/datasource/vdb/analyticdb/analyticdb_vector_sql.py
View File

@ -194,6 +194,8 @@ class AnalyticdbVectorBySql:
def search_by_vector(self, query_vector: list[float], **kwargs: Any) -> list[Document]: def search_by_vector(self, query_vector: list[float], **kwargs: Any) -> list[Document]:
top_k = kwargs.get("top_k", 4) top_k = kwargs.get("top_k", 4)
if not isinstance(top_k, int) or top_k <= 0:
raise ValueError("top_k must be a positive integer")
score_threshold = float(kwargs.get("score_threshold") or 0.0) score_threshold = float(kwargs.get("score_threshold") or 0.0)
with self._get_cursor() as cur: with self._get_cursor() as cur:
query_vector_str = json.dumps(query_vector) query_vector_str = json.dumps(query_vector)
@ -220,6 +222,8 @@ class AnalyticdbVectorBySql:
def search_by_full_text(self, query: str, **kwargs: Any) -> list[Document]: def search_by_full_text(self, query: str, **kwargs: Any) -> list[Document]:
top_k = kwargs.get("top_k", 4) top_k = kwargs.get("top_k", 4)
if not isinstance(top_k, int) or top_k <= 0:
raise ValueError("top_k must be a positive integer")
with self._get_cursor() as cur: with self._get_cursor() as cur:
cur.execute( cur.execute(
f"""SELECT id, vector, page_content, metadata_, f"""SELECT id, vector, page_content, metadata_,

2
api/core/rag/datasource/vdb/myscale/myscale_vector.py
View File

@ -125,6 +125,8 @@ class MyScaleVector(BaseVector):
def _search(self, dist: str, order: SortOrder, **kwargs: Any) -> list[Document]: def _search(self, dist: str, order: SortOrder, **kwargs: Any) -> list[Document]:
top_k = kwargs.get("top_k", 4) top_k = kwargs.get("top_k", 4)
if not isinstance(top_k, int) or top_k <= 0:
raise ValueError("top_k must be a positive integer")
score_threshold = float(kwargs.get("score_threshold") or 0.0) score_threshold = float(kwargs.get("score_threshold") or 0.0)
where_str = ( where_str = (
f"WHERE dist < {1 - score_threshold}" f"WHERE dist < {1 - score_threshold}"

6
api/core/rag/datasource/vdb/opengauss/opengauss.py
View File

@ -155,7 +155,8 @@ class OpenGauss(BaseVector):
:return: List of Documents that are nearest to the query vector. :return: List of Documents that are nearest to the query vector.
""" """
top_k = kwargs.get("top_k", 4) top_k = kwargs.get("top_k", 4)
if not isinstance(top_k, int) or top_k <= 0:
raise ValueError("top_k must be a positive integer")
with self._get_cursor() as cur: with self._get_cursor() as cur:
cur.execute( cur.execute(
f"SELECT meta, text, embedding <=> %s AS distance FROM {self.table_name}" f"SELECT meta, text, embedding <=> %s AS distance FROM {self.table_name}"
@ -174,7 +175,8 @@ class OpenGauss(BaseVector):
def search_by_full_text(self, query: str, **kwargs: Any) -> list[Document]: def search_by_full_text(self, query: str, **kwargs: Any) -> list[Document]:
top_k = kwargs.get("top_k", 5) top_k = kwargs.get("top_k", 5)
if not isinstance(top_k, int) or top_k <= 0:
raise ValueError("top_k must be a positive integer")
with self._get_cursor() as cur: with self._get_cursor() as cur:
cur.execute( cur.execute(
f"""SELECT meta, text, ts_rank(to_tsvector(coalesce(text, '')), plainto_tsquery(%s)) AS score f"""SELECT meta, text, ts_rank(to_tsvector(coalesce(text, '')), plainto_tsquery(%s)) AS score

5
api/core/rag/datasource/vdb/pgvector/pgvector.py
View File

@ -171,6 +171,8 @@ class PGVector(BaseVector):
:return: List of Documents that are nearest to the query vector. :return: List of Documents that are nearest to the query vector.
""" """
top_k = kwargs.get("top_k", 4) top_k = kwargs.get("top_k", 4)
if not isinstance(top_k, int) or top_k <= 0:
raise ValueError("top_k must be a positive integer")
with self._get_cursor() as cur: with self._get_cursor() as cur:
cur.execute( cur.execute(
@ -190,7 +192,8 @@ class PGVector(BaseVector):
def search_by_full_text(self, query: str, **kwargs: Any) -> list[Document]: def search_by_full_text(self, query: str, **kwargs: Any) -> list[Document]:
top_k = kwargs.get("top_k", 5) top_k = kwargs.get("top_k", 5)
if not isinstance(top_k, int) or top_k <= 0:
raise ValueError("top_k must be a positive integer")
with self._get_cursor() as cur: with self._get_cursor() as cur:
if self.pg_bigm: if self.pg_bigm:
cur.execute("SET pg_bigm.similarity_limit TO 0.000001") cur.execute("SET pg_bigm.similarity_limit TO 0.000001")