oracle-haystack 0.2.0__tar.gz → 0.3.0__tar.gz

{oracle_haystack-0.2.0 → oracle_haystack-0.3.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [integrations/oracle-v0.2.0] - 2026-04-23
+
+### 🚀 Features
+
+- Complete `OracleDocumentStore` operations (#3179)
+
+
 ## [integrations/oracle-v0.1.0] - 2026-04-16
 
 ### 🚀 Features

{oracle_haystack-0.2.0 → oracle_haystack-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oracle-haystack
-Version: 0.2.0
+Version: 0.3.0
 Summary: Oracle AI Vector Search DocumentStore integration for Haystack
 Project-URL: Source Code, https://github.com/deepset-ai/haystack-core-integrations/tree/main/integrations/oracle
 Project-URL: Bug Tracker, https://github.com/deepset-ai/haystack-core-integrations/issues

{oracle_haystack-0.2.0 → oracle_haystack-0.3.0}/src/haystack_integrations/document_stores/oracle/document_store.py

@@ -18,21 +18,14 @@ from haystack.document_stores.errors import DocumentStoreError, DuplicateDocumen
 from haystack.document_stores.types import DuplicatePolicy
 from haystack.utils import Secret, deserialize_secrets_inplace
 
-from .filters import FilterTranslator
+from .filters import FilterTranslator, _validate_field_path
 
 logger = logging.getLogger(__name__)
 
 _SAFE_TABLE_NAME = re.compile(r"^[A-Za-z_][A-Za-z0-9_$#]{0,127}$")
-_SAFE_FIELD_PATH = re.compile(r"^[A-Za-z0-9_.]+$")
 MAX_INDEX_NAME_LEN = 128
 
 
-def _validate_field_path(field_path: str) -> None:
-    if not _SAFE_FIELD_PATH.match(field_path):
-        msg = f"Invalid metadata field name: {field_path!r}"
-        raise ValueError(msg)
-
-
 def _try_parse_number(value: Any) -> Any:
     """
     Attempt to parse a string as a number.

{oracle_haystack-0.2.0 → oracle_haystack-0.3.0}/src/haystack_integrations/document_stores/oracle/filters.py

@@ -2,12 +2,20 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
+import re
 from datetime import datetime
 from typing import Any, ClassVar
 
 from haystack.errors import FilterError
 
 _RANGE_OPS = {">", ">=", "<", "<="}
+_SAFE_FIELD_PATH = re.compile(r"^[A-Za-z0-9_.]+$")
+
+
+def _validate_field_path(field_path: str) -> None:
+    if not _SAFE_FIELD_PATH.match(field_path):
+        msg = f"Invalid metadata field name: {field_path!r}"
+        raise FilterError(msg)
 
 
 class FilterTranslator:
@@ -123,14 +131,9 @@ class FilterTranslator:
             return "id"
         if field == "content":
             return "text"
-        if field.startswith("meta."):
-            key = field[len("meta.") :]
-            json_path = f"JSON_VALUE(metadata, '$.{key}')"
-            if isinstance(value, (int, float)) and not isinstance(value, bool):
-                return f"TO_NUMBER({json_path})"
-            return json_path
-        # Fallback: treat as top-level JSON key
-        json_path = f"JSON_VALUE(metadata, '$.{field}')"
+        key = field[len("meta.") :] if field.startswith("meta.") else field
+        _validate_field_path(key)
+        json_path = f"JSON_VALUE(metadata, '$.{key}')"
         if isinstance(value, (int, float)) and not isinstance(value, bool):
             return f"TO_NUMBER({json_path})"
         return json_path

{oracle_haystack-0.2.0 → oracle_haystack-0.3.0}/tests/test_filter_translator.py

@@ -2,6 +2,9 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
+import pytest
+from haystack.errors import FilterError
+
 from haystack_integrations.document_stores.oracle.filters import FilterTranslator
 
 
@@ -134,3 +137,24 @@ def test_param_counter_increments_correctly():
         }
     )
     assert set(params.keys()) == {"p0", "p1", "p2"}
+
+
+def test_sql_injection_via_field_name_raises():
+    with pytest.raises(FilterError, match="Invalid metadata field name"):
+        _translate({"field": "meta.x') = 'x' OR 1=1 OR ('a", "operator": "==", "value": "y"})
+
+
+def test_sql_injection_via_fallback_field_raises():
+    # Injection via the non-meta fallback path
+    with pytest.raises(FilterError, match="Invalid metadata field name"):
+        _translate({"field": "x') OR 1=1--", "operator": "==", "value": "y"})
+
+
+def test_sql_injection_in_not_in_raises():
+    with pytest.raises(FilterError, match="Invalid metadata field name"):
+        _translate({"field": "meta.x') OR 1=1--", "operator": "in", "value": ["a", "b"]})
+
+
+def test_valid_nested_field_path_accepted():
+    sql, _ = _translate({"field": "meta.author.city", "operator": "==", "value": "Berlin"})
+    assert "'$.author.city'" in sql