fix(security): prevent arbitrary file write in SQL editor (CVE-2024-10835)

[haawha]

Description

This PR fixes a critical security vulnerability (CVE-2024-10835) in the SQL editor API that could allow attackers to perform arbitrary file write operations through DuckDB SQL queries. The vulnerability could potentially lead to Remote Code Execution (RCE).

Key changes:

• Added database type validation to identify DuckDB connections
• Implemented comprehensive dangerous operation filtering for DuckDB
• Added SQL execution timeout protection (30s)
• Added file path pattern detection to block file operations
• Improved logging for security events
• Enhanced type conversion safety

How Has This Been Tested?

The security fix has been tested with:

1. Normal SQL Operations:

• Standard SELECT queries
• JOIN operations
• Aggregate functions
• Sub-queries

2. Security Tests:

• File operation attempts via DuckDB
• System command execution attempts
• Various SQL injection patterns
• Path traversal attempts
• Whitespace bypass attempts
• Timeout verification

Test Environment:

• Python 3.8+
• Latest DuckDB version
• Both Linux and Windows environments

Snapshots:

Include snapshots for easier review.

Checklist:

• My code follows the style guidelines of this project
• I have already rebased the commits and make the commit message conform to the project standard
• I have performed a self-review of my own code
• I have commented my code with clear English comments
• I have made corresponding changes to the documentation
• Security review has been completed
• All tests pass successfully
• No existing functionality is affected

[Aries-ckt]

LGTM

[haawha]

Hello, @Aries-ckt @sbabybird @AlphaHinex @xudafeng

How can my pr request be merged? Right now it needs to be approved by 2 reviewers to be automatically merged.

Also, #2269 is another pr I submitted.

[fangyinc]

LGTM

[fangyinc]

Thank you for your contribution, there is still a small problem, please format codes, you can run make fmt to format it.

[haawha]

Thank you for your contribution, there is still a small problem, please format codes, you can run make fmt to format it.

Thanks for the heads up. It's done and pushed.

[fangyinc]

LGTM

[Aries-ckt]

LGTM