Skip to content

Conversation

@hkdeman
Copy link
Contributor

@hkdeman hkdeman commented Sep 4, 2025

Closes #601

Summary

This PR adds support for displaying additional database entities beyond just Tables and Views.

Changes

Backend:

  • Extended plugin interface with methods for Functions, Procedures, Triggers, Indexes, Sequences, and Types
  • Implemented comprehensive PostgreSQL support for all entity types
  • Added MongoDB index support with type detection
  • Created GraphQL schema types and resolvers

Frontend:

  • Built generic EntityPage component for displaying all entity types
  • Updated sidebar navigation with entity-specific routes
  • Added appropriate icons and search functionality
  • Database-specific logic (e.g., Sequences/Types only for PostgreSQL)

Testing

  • Tested with PostgreSQL database
  • Verified MongoDB index display
  • Other SQL databases will show empty lists until specific implementations are added

Generated with Claude Code

…ures, Triggers, Indexes, Sequences, Types)

- Extended plugin interface with methods for each entity type
- Implemented comprehensive PostgreSQL support for all entity types
- Added MongoDB index support with type detection
- Created GraphQL schema types and resolvers
- Built generic EntityPage component for frontend display
- Updated sidebar navigation with entity-specific routes
- Added database-specific logic (e.g., Sequences/Types only for PostgreSQL)

Closes #601

Co-authored-by: H <hkdeman@users.noreply.github.com>
@jazzberry-ai
Copy link

jazzberry-ai bot commented Sep 4, 2025

Bug Report

Name: SQL/Command Injection Vulnerability in Database Schema Parameter
Severity: High
Example test case: Log in to the application with a valid user account. Navigate to the page displaying database entities (Functions, Procedures, Triggers, Indexes, Sequences, Types). Modify the schema parameter in the GraphQL query to include malicious SQL code (e.g., '; DROP TABLE users;--'). Submit the query and observe the results.
Description: The schema parameter used in the GraphQL resolvers for fetching database entities (Functions, Procedures, Triggers, Indexes, Sequences, Types) is vulnerable to SQL injection (PostgreSQL) and potential command injection (MongoDB). The parameter is directly used in SQL queries and MongoDB database selection without proper sanitization or validation. This could allow a malicious user to inject arbitrary code, potentially leading to unauthorized data access, manipulation, or denial of service.

Comments? Email us.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FR] - Add all different types of entities in databases

2 participants