From 9d1e2b92f501cf81d52db5628cbed1a7a69d5909 Mon Sep 17 00:00:00 2001 From: Wenjie Zhang Date: Thu, 15 Jan 2026 14:45:28 +0800 Subject: [PATCH] =?UTF-8?q?fix(agent-tools):=20=E4=BF=AE=E5=A4=8D=20SQL=20?= =?UTF-8?q?=E5=AE=89=E5=85=A8=E6=A3=80=E6=9F=A5=E8=AF=AF=E5=88=A4=E7=9A=84?= =?UTF-8?q?=E6=83=85=E5=86=B5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/agents/common/toolkits/mysql/security.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/agents/common/toolkits/mysql/security.py b/src/agents/common/toolkits/mysql/security.py index a87f1c29..b53e16c9 100644 --- a/src/agents/common/toolkits/mysql/security.py +++ b/src/agents/common/toolkits/mysql/security.py @@ -41,10 +41,14 @@ class MySQLSecurityChecker: if not any(sql_upper.startswith(op) for op in cls.ALLOWED_OPERATIONS): return False - # 检查危险关键词 - for keyword in cls.DANGEROUS_KEYWORDS: - if keyword in sql_upper: - return False + # 检查危险关键词 - 只检查语句开头的关键字，避免列名/表名误报 + # 提取语句开头的第一个词 + first_word_match = re.match(r"^\s*(\w+)", sql_upper) + first_word = first_word_match.group(1) if first_word_match else "" + + # 只在开头检查危险关键词 + if first_word in cls.DANGEROUS_KEYWORDS: + return False # 检查SQL注入模式 sql_injection_patterns = [