Release - Export functionality, SQLite non-strict handling, support for the enterprise module

[modelorona]

✨ Improvements

Export functionality for SQL databases, Elasticsearch, and MongoDB:

• You can now export tables to either CSV or Excel! Please note there might be some edge cases in data formatting, so if anything is off please let us know! 😊

Backend sorting capability for the table headers

• Better sorting with backend.

New UI and UX

• Use of the new clidey/ux package.

Mock data generation

• Mock data generation for tables is out! Use this feature to generate mock data for your tables for local testing.

🐛 Bug Fixes

SQLite handling for non-strict tables

• The SQLite plugin has been modified to support non-strict tables instead of strict tables. This might revert in the future but we think this will be easier for people at the moment.🦥

Support for the WhoDB Enterprise module

• We've now added our enterprise offering as a submodule instead of keeping it as a separate project. Ideally nothing should break for the community as this module is available only for contributors. 🚡

Table refresh issue

• Issue where table refresh was broken.

Scrolling bug

• Scrolling should be improved now.

Dependabot updates

• Updated several dependencies including driver updates, so if you run into any issues, please let us know! 🔧

---

Thank you to everyone who contributed to this release! 🚀
Your feedback and support are invaluable.

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
Information Disclosure	Medium	Requesting /config.json exposes the contents of the build/config.json file if it exists.	The fileServer function in core/src/router/file_server.go allows direct access to files within the embedded "build" directory if the file extension is known. This can lead to information disclosure if sensitive files are accidentally included in the embedded file system.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
Command Injection in build-backend.sh	High	1. Modify the Git configuration to inject malicious code into the output of git describe or git rev-parse. For example, set git config --global core.hooksPath "/tmp/evil" and create an executable /tmp/evil/describe that outputs a command to be executed. 2. Run the build-backend.sh script. 3. The injected code will be executed during the build process.	The build-backend.sh script uses shell commands (git describe, git rev-parse, date) to construct the LDFLAGS variable, which is then used in the go build command. This is vulnerable to command injection because the output of these commands is not properly sanitized before being included in the LDFLAGS. An attacker could exploit this vulnerability by injecting malicious code into the Git configuration or by compromising the commands themselves.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
Unprotected GraphQL Introspection	Medium	Configure GraphQL endpoint at a path other than /api/ and send an introspection query in production mode.	GraphQL introspection is not properly protected in production if the endpoint is not under /api/. This can reveal the entire schema.
Unauthenticated GetDatabase Operation	Medium	Send a GetDatabase GraphQL query with type=sqlite3 without authentication.	The GetDatabase operation is allowed without authentication for SQLite databases, which could be exploited if database details can be influenced by the user.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

| Name | Severity | Example test case | Description |
| SQL Injection in Raw Execute | Critical | Enter SELECT * FROM users; -- in the Raw Execute query editor | The RawExecute resolver directly executes user-provided SQL queries without sanitization, leading to SQL injection. |

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
Login Profile Credentials Overwrite Bypass	Medium	1. Create a valid token with a specific Id. 2. Modify the Id in the token to a non-existent login profile ID. 3. Send a request with this modified token.	The AuthMiddleware in core/src/auth/auth.go overwrites the user credentials with the login profile credentials if the Id matches. However, it does not check if a matching profile was actually found during the iteration of available login profiles. This allows a user to potentially bypass authentication or authorization by manipulating the Id in their token, causing the code to use the original credentials without verification, even if the profile ID no longer exists.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
SQL Injection in storage unit name	Critical	Create a storage unit named test; DROP TABLE test;. Navigate to the storage unit in the UI.	The application is vulnerable to SQL injection because it doesn't sanitize the storage unit name before using it in a SQL query. This allows an attacker to execute arbitrary SQL commands, potentially leading to data loss, privilege escalation, or other malicious actions.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
SQL Injection in Raw Execute	Critical	Execute SELECT * FROM users WHERE username = 'admin' OR '1'='1'; in the Raw Execute page.	The Raw Execute feature allows users to execute arbitrary SQL queries without proper sanitization, leading to SQL injection vulnerabilities. An attacker can use SQL injection to bypass security checks, access sensitive data, modify data, or even execute arbitrary code on the database server.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
Missing password hashing in login cookie	Critical	Inspect the cookie after logging in; the password is base64 encoded and directly readable.	The login function stores user credentials (including the password) in a base64 encoded cookie without any hashing. This allows an attacker who gains access to the cookie to directly extract the user's credentials.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
Authentication Bypass for UpdateSettings	Critical	Call the UpdateSettings GraphQL mutation without providing any authentication token.	The isAllowed function in auth.go allows unauthenticated access to the UpdateSettings operation. Although the current implementation of UpdateSettings is limited, future changes could introduce vulnerabilities if sensitive settings can be modified without authentication.
Insecure Token Validation	High	Attempt to reuse a previously valid token.	The isTokenValid function in auth.go validates tokens against a static list. This is vulnerable to replay attacks and lacks proper token revocation mechanisms.
Credentials Override	Medium	Manipulate the credentials.Id in a login request to match a different profile with higher privileges.	The AuthMiddleware in auth.go overrides credentials based on the profileId. This could lead to privilege escalation if an attacker can manipulate the credentials.Id.
Introspection Query Enabled in Development	Low	Send an introspection query to the GraphQL endpoint in development mode.	The isPublicRoute function in auth.go allows introspection queries in development mode, exposing the GraphQL schema.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
SQL Injection in GetCreateTableQuery	High	Provide a malicious schema name (e.g., 'public; DROP TABLE users;') when creating a table. The GetCreateTableQuery function will construct a SQL query that, when executed, will drop the users table.	The GetCreateTableQuery function in /root/whodb/core/src/plugins/postgres/add.go uses fmt.Sprintf to format the table name, which includes the schema and storage unit. If the schema or storage unit are taken from user input without proper validation, a malicious user can inject SQL commands, leading to potential data loss or unauthorized access.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
EE Component Loading Error	Medium	Modify ee-imports.ts to simulate a failed dynamic import of the EE module (e.g., by changing the import path to a non-existent module). Then, attempt to load a page that uses an EE component.	In frontend/src/config/ee-imports.ts, if the dynamic import of the EE module fails, the code attempts to access properties on a potentially null eeModule, which can lead to runtime errors like 'Cannot read properties of null'. A null check should be added before accessing properties of eeModule.

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
Potential SQL Injection Vulnerability in GORM Plugin (MySQL/MariaDB)	High	1. Configure a storage unit with a MySQL or MariaDB database.

2. Create a table with a column (e.g., id of type INT).
3. Attempt to update a row using the UpdateStorageUnit function with a crafted value in the whereConditions map that contains malicious SQL code. For example, set values["id"] = "1 OR 1=1; --"|The executeUpdateWithWhereMap function in core/src/plugins/gorm/update.go uses string formatting to construct the WHERE clause for update queries in MySQL/MariaDB. While the column name is escaped, the value is passed directly to the Where function without proper sanitization. This could allow an attacker to inject malicious SQL code into the query, potentially leading to data breaches or unauthorized modifications. The fix would be to properly escape/sanitize the 'value' or find a way to build the query using GORM's query builder to ensure parameters are properly escaped.

_{Comments? Email us.}