cfc6587e04
Why this change is needed: Two critical P0 security vulnerabilities were identified in CursorReview: 1. UnifiedLock silently allows unprotected execution when lock is None, creating false security and potential race conditions in multi-process scenarios 2. PostgreSQL migration copies ALL workspace data during legacy table migration, violating multi-tenant isolation and causing data leakage How it solves it: - UnifiedLock now raises RuntimeError when lock is None instead of WARNING - Added workspace parameter to setup_table() for proper data isolation - Migration queries now filter by workspace in both COUNT and SELECT operations - Added clear error messages to help developers diagnose initialization issues Impact: - lightrag/kg/shared_storage.py: UnifiedLock raises exception on None lock - lightrag/kg/postgres_impl.py: Added workspace filtering to migration logic - tests/test_unified_lock_safety.py: 3 tests for lock safety - tests/test_workspace_migration_isolation.py: 3 tests for workspace isolation - tests/test_dimension_mismatch.py: Updated table names and mocks - tests/test_postgres_migration.py: Updated mocks for workspace filtering Testing: - All 31 tests pass (16 migration + 4 safety + 3 lock + 3 workspace + 5 dimension) - Backward compatible: existing code continues working unchanged - Code style verified with ruff and pre-commit hooks |
||
|---|---|---|
| .. | ||
| api | ||
| evaluation | ||
| kg | ||
| llm | ||
| tools | ||
| __init__.py | ||
| base.py | ||
| constants.py | ||
| exceptions.py | ||
| lightrag.py | ||
| namespace.py | ||
| operate.py | ||
| prompt.py | ||
| rerank.py | ||
| types.py | ||
| utils.py | ||
| utils_graph.py | ||