Community: Using ro_qeury with FalkorDB doesn't allow destructive operations

[gkorland]

ref #28050

Thank you for contributing to LangChain!

• PR title: "package: description"

  • Where "package" is whichever of langchain, community, core, etc. is being modified. Use "docs: ..." for purely docs changes, "infra: ..." for CI changes.
  • Example: "community: add foobar LLM"

• PR message: No need to force opt in with FalkorDB

  • Description: Using ro_qeury with FalkorDB doesn't allow destructive operations
  • Twitter handle: @g_korland

• Lint and test: Run make format, make lint and make test from the root of the package(s) you've modified. See contribution guidelines for more: https://python.langchain.com/docs/contributing/

@efriis

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
langchain	⬜️ Ignored (Inspect)	Visit Preview		Dec 5, 2024 7:01pm

[efriis]

this introduces a CVE by removing danger warnings about sql injection

[efriis]

here's the CVE: GHSA-45pg-36p6-83v9

the issue is not only destructive actions, but also data exfiltration

[efriis]

if you wanted to reopen this just switching to ro_query that could work, under some flag. But it would have to keep the security warning