0.65.1 — Security release

A security patch closing a bypass of the SQL function-name blocklist that shipped in 0.64.0. Upgrading is recommended for anyone using SQLChatAgent with PostgreSQL — especially deployments where LLM-influenced SQL runs against a role that can call pg_read_file.

pip install -U langroid

Security fix

SQLChatAgent dangerous-function blocklist bypassable via quoted / commented / schema-qualified calls

Advisory: GHSA-6xc5-4r68-67fc — High, CWE-22 / CWE-89

The dangerous-function regex shipped in 0.64.0 (see parent advisory GHSA-pmch-g965-grmr) requires a function name to be followed directly by \s*\(. PostgreSQL accepts equivalent calls where the name is separated from ( by a quoted identifier, an inline comment, or schema qualification:

SELECT "pg_read_file"('/etc/passwd')
SELECT pg_read_file/**/('/etc/passwd')
SELECT pg_catalog."pg_read_file"('/etc/passwd')

All three evade the regex, still parse as SELECT, and execute the same server-side pg_read_file file-read primitive — re-opening the very vulnerability the 0.64.0 fix was meant to close.

Fix: after the existing sqlglot parse, walk the AST and reject any function call whose normalized (unquoted, schema-stripped, case-folded) name is in the dangerous set or matches a dangerous prefix (pg_read*, pg_stat*, pg_ls*, pg_current_logfile*, lo_*, load_file, load_extension, sp_oacreate, sp_oamethod). sqlglot normalizes all three bypass forms to the same Anonymous node, so one AST check catches every variant. The pre-existing raw-text regex blocklist is kept as a cheap pre-filter (defense in depth).

Reported by @dodge1218.

Behavior change

This strictly tightens an existing security check: SQLChatAgent will now reject additional PostgreSQL-specific obfuscations of pg_read_file and related functions that previously slipped through the regex. If your application legitimately needs to call these functions (it should not), set allow_dangerous_operations=True on SQLChatAgentConfig.

Upgrade

pip install -U langroid

Full changelog: 0.65.0...0.65.1