v0.5.15: add tools, revert subblock prop change #2152
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* feat(tools): added rds tools/block * feat(tools): added rds, dynamodb, background color gradient * changed conditions for WHERE condition to be json conditions instead of raw string
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Contributor
Greptile OverviewGreptile SummaryThis PR adds RDS and DynamoDB tool integrations, updates gradient backgrounds for AWS blocks, and reverts a subblock prop change. The implementations include comprehensive CRUD operations with proper AWS SDK integration and parameterized queries. Major Changes:
Critical Issue Found:
Positive Notes:
Confidence Score: 2/5
Important Files ChangedFile Analysis
Sequence DiagramsequenceDiagram
participant User
participant BlockUI as Block UI
participant ToolInput as Tool Input Component
participant API as API Route
participant Utils as Utils Layer
participant AWS as AWS SDK
User->>BlockUI: Select operation (e.g., RDS Query)
BlockUI->>ToolInput: Configure params (credentials, query)
ToolInput->>API: POST /api/tools/rds/query
API->>API: Validate schema with Zod
API->>API: validateQuery() check
API->>Utils: createRdsClient(config)
Utils->>AWS: new RDSDataClient()
API->>Utils: executeStatement(client, params)
Utils->>AWS: ExecuteStatementCommand
AWS-->>Utils: Response with records
Utils->>Utils: parseRdsResponse()
Utils-->>API: { rows, rowCount }
API-->>ToolInput: JSON response
ToolInput-->>BlockUI: Display results
BlockUI-->>User: Show output
Note over API,Utils: DynamoDB follows similar pattern
Note over API: Execute endpoint bypasses validateQuery()!
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+26
to
+44
| logger.info(`[${requestId}] Executing raw SQL on RDS database ${params.database}`) | ||
|
|
||
| const client = createRdsClient({ | ||
| region: params.region, | ||
| accessKeyId: params.accessKeyId, | ||
| secretAccessKey: params.secretAccessKey, | ||
| resourceArn: params.resourceArn, | ||
| secretArn: params.secretArn, | ||
| database: params.database, | ||
| }) | ||
|
|
||
| try { | ||
| const result = await executeStatement( | ||
| client, | ||
| params.resourceArn, | ||
| params.secretArn, | ||
| params.database, | ||
| params.query | ||
| ) |
Contributor
There was a problem hiding this comment.
logic: Missing query validation allows unrestricted SQL execution. The execute endpoint doesn't call validateQuery() unlike the query endpoint (apps/sim/app/api/tools/rds/query/route.ts:29), allowing dangerous operations like DROP DATABASE, CREATE USER, GRANT, etc.
Suggested change
| logger.info(`[${requestId}] Executing raw SQL on RDS database ${params.database}`) | |
| const client = createRdsClient({ | |
| region: params.region, | |
| accessKeyId: params.accessKeyId, | |
| secretAccessKey: params.secretAccessKey, | |
| resourceArn: params.resourceArn, | |
| secretArn: params.secretArn, | |
| database: params.database, | |
| }) | |
| try { | |
| const result = await executeStatement( | |
| client, | |
| params.resourceArn, | |
| params.secretArn, | |
| params.database, | |
| params.query | |
| ) | |
| logger.info(`[${requestId}] Executing raw SQL on RDS database ${params.database}`) | |
| // Validate the query | |
| const validation = validateQuery(params.query) | |
| if (!validation.isValid) { | |
| logger.warn(`[${requestId}] Query validation failed: ${validation.error}`) | |
| return NextResponse.json({ error: validation.error }, { status: 400 }) | |
| } | |
| const client = createRdsClient({ |
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/tools/rds/execute/route.ts
Line: 26:44
Comment:
**logic:** Missing query validation allows unrestricted SQL execution. The `execute` endpoint doesn't call `validateQuery()` unlike the `query` endpoint (`apps/sim/app/api/tools/rds/query/route.ts:29`), allowing dangerous operations like `DROP DATABASE`, `CREATE USER`, `GRANT`, etc.
```suggestion
logger.info(`[${requestId}] Executing raw SQL on RDS database ${params.database}`)
// Validate the query
const validation = validateQuery(params.query)
if (!validation.isValid) {
logger.warn(`[${requestId}] Query validation failed: ${validation.error}`)
return NextResponse.json({ error: validation.error }, { status: 400 })
}
const client = createRdsClient({
```
How can I resolve this? If you propose a fix, please make it concise.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
feat(tools): added rds, dynamodb, background color gradient (#2150)
fix(selector): remove subblock state prop for subblock component (#2151)