CVE-2023-36189: Mitigate issue #5923 (Prompt injection -> SQL injection in SQLChain) by boazwasserman · Pull Request #6051 · hwchase17/langchain

Add validation controls to the SQL chain to mitigate SQL injection issues.
Using sqlfluff to perform static analysis:

1. Disallow non select statement (INSERT, DROP)
2. Disallow wildcard select statement

Some dialects that are supported by langchain are not supported by sqlfluff. It is possible to disallow usage of such dialects as well.

Also fixed the SQL integration tests which were not working as expected

Fixes #5923

BTW, looks like there is a huge diff on poetry.lock which doesn’t look OK to me, would appreciate any advice on how to resovle it (I was following the instructions found here https://github.com/hwchase17/langchain/blob/master/.github/CONTRIBUTING.md)

Who can review?

@hwchase17