The GitHub Actions job "Check newsfragment PR number" on airflow.git/feature/flag-missing-conn-fields has failed. Run started by GitHub user dabla (triggered by dabla).
Head commit for run: e25569f9646cef99dba198527e26af99fca282f7 / Kaxil Naik <[email protected]> Harden common.ai SQLToolset allowed_tables against function/COPY bypass (#70134) SQLToolset(allowed_tables=[...]) restricts which tables an LLM agent's SQL can reach, but the check only inspected table references. A SQL function whose argument is a file path or a SQL string carries no table node, so pg_read_file('/etc/passwd'), query_to_xml('SELECT ... FROM other_table'), and COPY ... FROM PROGRAM (under allow_writes) slipped past the guardrail. collect_table_references now rejects COPY and -- fail-closed -- every function sqlglot cannot type (exp.Anonymous), the channel those functions use. Ordinary builtins (count, lower) are recognised and pass; a legitimate unrecognised function (json_build_object) or a project UDF is permitted via the new allowed_functions parameter. This avoids maintaining an unbounded denylist of dangerous names and matches the module's allowlist philosophy: an incomplete allow-list refuses a query, it never leaks. The guardrail stays best-effort: a least-privilege database role remains the hard boundary, and the docs, docstrings, and SQL example DAG lead with that guidance. Report URL: https://github.com/apache/airflow/actions/runs/29835325672 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
