mirror of https://github.com/pgadmin-org/pgadmin4.git synced 2026-08-19 01:15:04 -05:00

Files

T

Ashesh Vashi 24485fe964 fix: prevent LFI and SSRF in LLM API configuration endpoints (#9900 )

User-supplied api_key_file and api_url preferences fed pgAdmin's LLM
provider clients without validation. An authenticated user could read
arbitrary server-side files (LFI) or coerce pgAdmin into requesting
internal targets such as 169.254.169.254 (SSRF) via the chat path and
model-list endpoints.

- validate_api_key_path() restricts user-supplied paths to the user's
  private storage directory in server mode (covering both old- and
  new-style names) or the home directory in desktop mode; resolves
  symlinks and rejects null bytes. Shared storage is intentionally
  excluded since API keys are per-user secrets.
- _read_api_key_from_file() caps reads at 1024 bytes and enforces a
  printable-ASCII no-whitespace key shape so it cannot be repurposed
  as an arbitrary file reader.
- validate_api_url() enforces config.ALLOWED_LLM_API_URLS by exact
  scheme://host:port match, applied at refresh endpoints, accessor
  fallbacks, and provider client constructors so the chat path is
  also covered. Logs a startup warning if the allowlist is empty.
- Adds test coverage for path validation, URL validation, refresh-
  endpoint rejection paths, and refresh-endpoint happy paths.

Reported-by: j3seer <jasserchebbi@outlook.com>

2026-05-01 16:38:48 +05:30

prompts

Fix an issue where LLM responses are not streamed or rendered properly in the AI Assistant. #9734

2026-03-17 11:41:57 +05:30

providers

Support /v1/responses for OpenAI models. #9795

2026-03-30 14:16:22 +05:30

reports

Fixed an issue where AI Reports fail with OpenAI models that do not support the temperature parameter. #9719

2026-03-16 12:13:04 +05:30

static/js

Fixed an issue where AI features are visible in the UI even when LLM_ENABLED is set to False.

2026-03-16 12:35:16 +05:30

tests

fix: prevent LFI and SSRF in LLM API configuration endpoints (#9900 )

2026-05-01 16:38:48 +05:30

tools

Core LLM integration infrastructure to allow pgAdmin to connect to AI providers. #9641

2026-02-17 17:16:06 +05:30

__init__.py

fix: prevent LFI and SSRF in LLM API configuration endpoints (#9900 )

2026-05-01 16:38:48 +05:30

chat.py

Fix an issue where LLM responses are not streamed or rendered properly in the AI Assistant. #9734

2026-03-17 11:41:57 +05:30

client.py

Fix an issue where LLM responses are not streamed or rendered properly in the AI Assistant. #9734

2026-03-17 11:41:57 +05:30

compaction.py

Fix an issue where the AI Assistant was not retaining conversation context between messages, with chat history compaction to manage token budgets.

2026-03-16 19:02:36 +05:30

models.py

Core LLM integration infrastructure to allow pgAdmin to connect to AI providers. #9641

2026-02-17 17:16:06 +05:30

README.md

Core LLM integration infrastructure to allow pgAdmin to connect to AI providers. #9641

2026-02-17 17:16:06 +05:30

utils.py

fix: prevent LFI and SSRF in LLM API configuration endpoints (#9900 )

2026-05-01 16:38:48 +05:30

README.md

pgAdmin LLM Integration

This module provides AI/LLM functionality for pgAdmin, including database security analysis, performance reports, and design reviews powered by large language models.

Features

Security Reports: Analyze database configurations for security issues
Performance Reports: Get optimization recommendations for databases
Design Reviews: Review schema design and structure
Streaming Reports: Real-time report generation with progress updates via Server-Sent Events (SSE)

Supported LLM Providers

Anthropic Claude (recommended)
OpenAI GPT
Ollama (local models)

Configuration

Configure LLM providers in config.py:

DEFAULT_LLM_PROVIDER: Set to 'anthropic', 'openai', or 'ollama'
ANTHROPIC_API_KEY_FILE: Path to file containing Anthropic API key
OPENAI_API_KEY_FILE: Path to file containing OpenAI API key
OLLAMA_API_URL: URL for Ollama server (e.g., 'http://localhost:11434')

If API keys are not found, the LLM features will be gracefully disabled.

Testing

Python Tests

The Python test suite uses pgAdmin's existing test framework based on BaseTestGenerator with the scenarios pattern.

Run all LLM tests:

cd web/regression
python3 runtests.py --pkg llm

Run specific test modules:

python3 runtests.py --pkg llm --modules test_llm_status
python3 runtests.py --pkg llm --modules test_report_endpoints

JavaScript Tests

The JavaScript test suite uses Jest with React Testing Library.

Run all JavaScript tests (including LLM tests):

cd web
yarn run test:js

Run only LLM JavaScript tests:

cd web
yarn run test:js-once -- llm

Test Coverage

The tests use mocking to avoid requiring actual LLM API credentials. All external dependencies (utility functions, report generators) are mocked, allowing the tests to run in CI/CD environments without any API keys configured.

Test files:

tests/test_llm_status.py - Tests LLM client initialization and status endpoint
tests/test_report_endpoints.py - Tests report generation endpoints at server, database, and schema levels
regression/javascript/llm/AIReport.spec.js - Tests React component for report display

Architecture

client.py - LLM client abstraction layer supporting multiple providers
reports/ - Report generation system
- generator.py - Main report generation logic
- security.py - Security analysis prompts and logic
- performance.py - Performance analysis prompts and logic
- design.py - Design review prompts and logic
views.py - Flask endpoints for reports and chat
static/js/AIReport.jsx - React component for displaying reports with dark mode support

Usage

Access AI reports through the pgAdmin browser tree:

Right-click on a server, database, or schema
Select "AI Analysis" submenu
Choose report type (Security, Performance, or Design)
View streaming report generation with progress updates
Download reports as markdown files