Ruben Fiszel 54f5a19377 fix: prevent SQL injection in job query parameters (#8494) ...

Replace unsafe string interpolation (format!("'{}'", t)) with
sql_builder::quote() in SQL query construction. The tags parameter in
count_completed_jobs_detail was directly interpolated without escaping,
allowing authenticated users to inject arbitrary SQL via the query string.

Also hardens LIKE clauses, JSON operators, and JOIN conditions across
query.rs and variables.rs that used manual .replace("'", "''") instead
of the crate's quote() function, and converts format-interpolated bind
values to parameterized queries where possible.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-24 13:23:43 +00:00

..

mcp

feat: mcp oauth gateway (#8443)

2026-03-20 16:12:59 +00:00

native_triggers

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

triggers

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

ai.rs

feat: support custom headers in customai resource type (#8364)

2026-03-16 11:31:22 +00:00

approvals.rs

feat: add resume and cancel button text options to Slack approval API + formatted args + typo (#8095)

2026-02-25 17:28:06 +00:00

apps_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

apps.rs

fix: Move database manager SQL queries to backend (#8306)

2026-03-24 09:45:37 +00:00

args.rs

fix(backend): use filename instead of content_type to detect file fields in multipart form data (#8054)

2026-02-23 11:05:29 +00:00

audit.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

auth.rs

feat: make WM_END_USER_EMAIL display users from different workspaces (#8208)

2026-03-04 11:50:59 +00:00

azure_proxy_oss.rs

feat: DuckDB support write to Azure (#7618)

2026-01-20 12:52:58 +00:00

bedrock.rs

feat(ai): add AWS bedrock session token support (#7908)

2026-02-11 19:29:58 +00:00

capture.rs

feat: add auto_commit option to Kafka triggers with advanced UI badges (#8317)

2026-03-12 14:00:30 +00:00

concurrency_groups.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

db.rs

fix: skip down migrations in potentially_stale checksum comparison (#8271)

2026-03-08 16:18:22 +00:00

drafts.rs

use excluded where relevant

2025-10-16 09:19:44 +00:00

ee_oss.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

embeddings.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

favorite.rs

feat: favorite datatable and ducklake tables + asset page nits (#7795)

2026-02-04 18:48:51 +00:00

flows.rs

chore: split api-scripts and api-flows

2026-02-11 13:27:00 +00:00

folder_history.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

folders.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

git_sync_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

google.rs

feat: add Vertex AI support for Google Gemini models (#8303)

2026-03-10 18:20:19 +00:00

granular_acls.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

group_history.rs

nit

2025-12-15 20:35:51 +00:00

groups.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

health.rs

feat: add OTel metrics support (#8442)

2026-03-19 08:10:37 +00:00

indexer_oss.rs

feat: move index management out of /srch/, add storage size reporting (#8169)

2026-03-03 16:46:10 +00:00

inkeep_oss.rs

feat(mcp): add documentation endpoint (#7331)

2025-12-10 17:28:56 +00:00

integration.rs

feat: private hub (#3491)

2024-04-04 04:16:53 +02:00

internal_db.rs

fix: Move database manager SQL queries to backend (#8306)

2026-03-24 09:45:37 +00:00

job_helpers_oss.rs

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

job_metrics.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

jobs_export.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

jobs.rs

fix: prevent SQL injection in job query parameters (#8494)

2026-03-24 13:23:43 +00:00

lib.rs

fix: Move database manager SQL queries to backend (#8306)

2026-03-24 09:45:37 +00:00

live_migrations.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

mcp_oauth_oss.rs

feat(aiagent): handle oauth for mcp tools (#7564)

2026-01-14 12:06:40 +00:00

mcp_tools.rs

reorg mcp_tools

2026-02-11 06:44:10 +00:00

oauth2_oss.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

oidc_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

public_app_layer.rs

feat(aiagent): handle oauth for mcp tools (#7564)

2026-01-14 12:06:40 +00:00

public_app_rate_limit.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

raw_apps.rs

remove legacy RawAppService endpoints

2026-02-08 23:59:40 +00:00

resources.rs

reorg mcp_tools

2026-02-11 06:44:10 +00:00

s3_proxy_oss.rs

fix s3 proxy dev build (#6535)

2025-09-04 22:05:22 +00:00

saml_oss.rs

SSRF protection for SAML and MCP OAuth endpoints (#8473)

2026-03-22 17:18:22 +00:00

scim_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

scripts.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

secret_backend_ext.rs

refactor: extract windmill-dep-map crate for parallel api/worker compilation (#7846)

2026-02-08 00:39:56 +00:00

service_logs.rs

feat: make WINDMILL_DIR configurable via environment variable (#8215)

2026-03-04 08:53:25 +00:00

slack_approvals.rs

feat: add resume and cancel button text options to Slack approval API + formatted args + typo (#8095)

2026-02-25 17:28:06 +00:00

smtp_server_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

static_assets.rs

fix static assets loading for apps raw

2025-12-25 16:29:49 +00:00

stripe_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

teams_approvals_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

teams_cache_oss.rs

fix: teams api improvements (#6643)

2025-09-19 17:43:16 +00:00

teams_oss.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

token.rs

feat: nextcloud native triggers (#6797)

2026-01-26 16:49:52 +00:00

tracing_init.rs

nit

2025-09-11 21:57:56 +00:00

users_oss.rs

handle OSS onboarding error gracefully (#8459)

2026-03-20 12:37:05 +00:00

users.rs

feat: google native triggers (#7837)

2026-02-16 15:52:02 +00:00

utils.rs

refactor: extract 12 leaf crates from windmill-api (#7899)

2026-02-11 10:31:03 +00:00

variables.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

volumes_oss.rs

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

webhook_util.rs

refactor: extract windmill-dep-map crate for parallel api/worker compilation (#7846)

2026-02-08 00:39:56 +00:00

workspace_dependencies.rs

feat: add git sync support for workspace dependencies (#8144)

2026-03-10 11:29:11 +00:00

workspaces_export.rs

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

workspaces.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00