The GitHub Actions job "Tests (AMD)" on airflow.git/harden-sqltoolset-allowed-tables has failed. Run started by GitHub user kaxil (triggered by kaxil).
Head commit for run: 75503e80a65c341049e2751ccb5e63630260a7cd / Kaxil Naik <[email protected]> Harden common.ai SQLToolset allowed_tables against function/COPY bypass SQLToolset(allowed_tables=[...]) restricts which tables an LLM agent's SQL can reach, but the check only inspected table references. A SQL function whose argument is a file path or a SQL string carries no table node, so pg_read_file('/etc/passwd'), query_to_xml('SELECT ... FROM other_table'), and COPY ... FROM PROGRAM (under allow_writes) slipped past the guardrail. collect_table_references now rejects COPY and -- fail-closed -- every function sqlglot cannot type (exp.Anonymous), the channel those functions use. Ordinary builtins (count, lower) are recognised and pass; a legitimate unrecognised function (json_build_object) or a project UDF is permitted via the new allowed_functions parameter. This avoids maintaining an unbounded denylist of dangerous names and matches the module's allowlist philosophy: an incomplete allow-list refuses a query, it never leaks. The guardrail stays best-effort: a least-privilege database role remains the hard boundary, and the docs, docstrings, and SQL example DAG lead with that guidance. Report URL: https://github.com/apache/airflow/actions/runs/29751495352 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
