The GitHub Actions job "npm_and_yarn in /providers/common/ai/src/airflow/providers/common/ai/plugins/www, /ts-sdk for brace-expansion - Update #1471571631" on airflow.git/main has failed. Run started by GitHub user dependabot[bot] (triggered by dependabot[bot]).
Head commit for run: c49e1c917ea2729eb862daad40f340a9d7dd6c4c / Kaxil Naik <[email protected]> Harden common.ai SQLToolset allowed_tables against function/COPY bypass (#70134) SQLToolset(allowed_tables=[...]) restricts which tables an LLM agent's SQL can reach, but the check only inspected table references. A SQL function whose argument is a file path or a SQL string carries no table node, so pg_read_file('/etc/passwd'), query_to_xml('SELECT ... FROM other_table'), and COPY ... FROM PROGRAM (under allow_writes) slipped past the guardrail. collect_table_references now rejects COPY and -- fail-closed -- every function sqlglot cannot type (exp.Anonymous), the channel those functions use. Ordinary builtins (count, lower) are recognised and pass; a legitimate unrecognised function (json_build_object) or a project UDF is permitted via the new allowed_functions parameter. This avoids maintaining an unbounded denylist of dangerous names and matches the module's allowlist philosophy: an incomplete allow-list refuses a query, it never leaks. The guardrail stays best-effort: a least-privilege database role remains the hard boundary, and the docs, docstrings, and SQL example DAG lead with that guidance. Report URL: https://github.com/apache/airflow/actions/runs/29835311094 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
