Skip to content

fix: FLOWISE-553, 598, 616#6464

Open
0xi4o wants to merge 7 commits into
mainfrom
fix/typeorm
Open

fix: FLOWISE-553, 598, 616#6464
0xi4o wants to merge 7 commits into
mainfrom
fix/typeorm

Conversation

@0xi4o

@0xi4o 0xi4o commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces security enhancements to sanitize TypeORM connection options via sanitizeDataSourceOptions and validate SQLite database paths using validateSQLitePath across multiple database, memory, and vector store nodes. The review feedback highlights critical security and compatibility improvements: using the in operator instead of hasOwnProperty to prevent prototype pollution bypasses, validating databaseFilePath in AgentMemory to block path traversal, adding tests for prototype chain pollution, and handling case-insensitive path comparisons on Windows to avoid false positives.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Comment thread packages/components/src/sanitizeDataSourceOptions.ts
Comment thread packages/components/nodes/memory/AgentMemory/AgentMemory.ts
Comment thread packages/components/nodes/memory/AgentMemory/AgentMemory.ts
Comment thread packages/components/src/sanitizeDataSourceOptions.test.ts
Comment thread packages/components/src/validator.ts Outdated
@0xi4o 0xi4o marked this pull request as ready for review June 10, 2026 07:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants