CVE-2026-9566

@@ -153,7 +153,7 @@ describe('SelectQueryPostgres FROMNOW/TONOW', () => {
 });
 
 describe('SelectQueryPostgres workday', () => {
-  it('uses interval multiplication for dynamic day-count expressions', () => {
+  it('generates CTE-based workday SQL that skips weekends and holidays', () => {
     const query = new SelectQueryPostgres();
     query.setContext({ timeZone: 'Asia/Shanghai' } as unknown as never);
     query.setCallMetadata([
@@ -162,7 +162,9 @@ describe('SelectQueryPostgres workday', () => {
     ] as unknown as never);
 
     const sql = query.workday('"t"."Date"', '"t"."Number"');
-    expect(sql).toContain(`INTERVAL '1 day' * ("t"."Number")::double precision`);
-    expect(sql).not.toContain(" days'");
+    expect(sql).toContain('WITH params AS');
+    expect(sql).toContain('generate_series');
+    expect(sql).toContain('EXTRACT(DOW FROM c.candidate_date)');
+    expect(sql).toContain(`("t"."Number")::double precision`);
   });
 });

@@ -4,24 +4,66 @@ import { getRandomString } from '@teable/core';
 import type { JobsOptions } from 'bullmq';
 import { localQueueEventEmitter } from './event-emitter';
 
+interface ILocalJob {
+  id: string;
+  name: string;
+  data: unknown;
+  opts?: JobsOptions;
+  queueName: string;
+  progress: number | object;
+  returnvalue: unknown;
+  failedReason?: string;
+  state: string;
+  getState: () => Promise<string>;
+  updateProgress: (progress: number | object) => Promise<void>;
+}
+
 export const createLocalQueueProvider = (queueName: string): Provider => ({
   provide: getQueueToken(queueName),
   useFactory: async () => {
+    const jobs = new Map<string, ILocalJob>();
+
+    const createJob = (id: string, name: string, data: unknown, opts?: JobsOptions): ILocalJob => {
+      const job: ILocalJob = {
+        id,
+        name,
+        data,
+        opts,
+        queueName,
+        progress: 0,
+        returnvalue: undefined,
+        failedReason: undefined,
+        state: 'waiting',
+        getState: async () => job.state,
+        updateProgress: async (p: number | object) => {
+          job.progress = p;
+        },
+      };
+      return job;
+    };
+
     return {
       add: (name: string, data: unknown, opts?: JobsOptions) => {
-        localQueueEventEmitter.emit(`handle-listener-${queueName}`, {
-          id: getRandomString(10),
-          name,
-          data,
-          opts,
-          queueName,
-        });
+        const id = opts?.jobId ?? getRandomString(10);
+        const job = createJob(id, name, data, opts);
+        jobs.set(id, job);
+        localQueueEventEmitter.emit(`handle-listener-${queueName}`, job);
+        return job;
       },
-      addBulk: (jobs: JobsOptions[]) => {
-        jobs.forEach((job) => {
+      addBulk: (bulkJobs: JobsOptions[]) => {
+        bulkJobs.forEach((job) => {
           localQueueEventEmitter.emit(`handle-listener-${queueName}`, job);
         });
       },
+      getJob: async (jobId: string) => {
+        return jobs.get(jobId) ?? null;
+      },
+      getJobs: async () => {
+        return Array.from(jobs.values());
+      },
+      getJobCountByTypes: async () => {
+        return jobs.size;
+      },
     };
   },
 });

@@ -1,6 +1,16 @@
 import type { Response } from 'express';
 import type { IOauth2State } from '../../../cache/types';
 
+function isValidRedirectPath(path: string): boolean {
+  try {
+    const base = 'http://placeholder.local';
+    const url = new URL(path, base);
+    return url.origin === base && (url.protocol === 'http:' || url.protocol === 'https:');
+  } catch {
+    return false;
+  }
+}
+
 export class ControllerAdapter {
   // eslint-disable-next-line @typescript-eslint/no-empty-function
   async authenticate() {}
@@ -12,7 +22,7 @@ export class ControllerAdapter {
       req.login(user, (err) => (err ? reject(err) : resolve()));
     });
     const redirectUri = (req.authInfo as { state: IOauth2State })?.state?.redirectUri;
-    if (redirectUri) {
+    if (redirectUri && isValidRedirectPath(redirectUri)) {
       return res.redirect(redirectUri);
     }
     return res.redirect(defaultRedirectUri || '/');

@@ -10,7 +10,14 @@ import {
   DEFAULT_MAX_SEARCH_FIELD_COUNT,
 } from '@teable/openapi';
 import { LocalStorageKeys, useView } from '@teable/sdk';
-import { useBaseId, useFields, useRowCount, useSearch, useTableId } from '@teable/sdk/hooks';
+import {
+  useBaseId,
+  useFields,
+  useRowCount,
+  useSearch,
+  useTableId,
+  useTablePermission,
+} from '@teable/sdk/hooks';
 import { Spin } from '@teable/ui-lib/base';
 import {
   cn,
@@ -69,6 +76,8 @@ export const SearchButton = (props: ISearchButtonProps) => {
   const [noPrompt, setNoPrompt] = useState(false);
   const baseId = useBaseId();
   const queryClient = useQueryClient();
+  const permission = useTablePermission();
+  const hasTableUpdatePermission = Boolean(permission['table|update']);
 
   const [inputValue, setInputValue] = useState(value);
   const [isFocused, setIsFocused] = useState(false);
@@ -373,6 +382,7 @@ export const SearchButton = (props: ISearchButtonProps) => {
           }}
           onChange={(e) => {
             if (
+              hasTableUpdatePermission &&
               shouldTips &&
               rowCount &&
               rowCount > RecommendedIndexRow &&
@@ -384,9 +394,8 @@ export const SearchButton = (props: ISearchButtonProps) => {
               setAlertVisible(true);
               return;
             }
-            if (searchAbnormalIndex.length) {
+            if (hasTableUpdatePermission && searchAbnormalIndex.length) {
               setAlertVisible(true);
-              return;
             }
             setInputValue(e.target.value);
             if (e.target.value === '') {
@@ -424,7 +433,7 @@ export const SearchButton = (props: ISearchButtonProps) => {
         </div>
       </div>
 
-      <AlertDialog open={alertVisible} onOpenChange={setAlertVisible}>
+      <AlertDialog open={hasTableUpdatePermission && alertVisible} onOpenChange={setAlertVisible}>
         <AlertDialogContent>
           <AlertDialogHeader>
             <AlertDialogTitle>{t('table:import.title.tipsTitle')}</AlertDialogTitle>

@@ -5,6 +5,7 @@ import { useTranslation } from 'next-i18next';
 import { useMemo } from 'react';
 import { useEnv } from '@/features/app/hooks/useEnv';
 import { authConfig } from '@/features/i18n/auth.config';
+import { isValidRedirectPath } from '@/lib/isValidRedirectPath';
 
 export const providersAll = [
   {
@@ -30,7 +31,9 @@ export const SocialAuth = () => {
   const { t } = useTranslation(authConfig.i18nNamespaces);
   const { socialAuthProviders, passwordLoginDisabled } = useEnv();
   const router = useRouter();
-  const redirect = router.query.redirect as string;
+  const rawRedirect = router.query.redirect as string;
+  const redirect =
+    rawRedirect && isValidRedirectPath(rawRedirect, window.location.origin) ? rawRedirect : '';
 
   const providers = useMemo(
     () => providersAll.filter((provider) => socialAuthProviders?.includes(provider.id)),

@@ -10,6 +10,7 @@ import { useBrand } from '@/features/app/hooks/useBrand';
 import { useEnv } from '@/features/app/hooks/useEnv';
 import { useInitializationZodI18n } from '@/features/app/hooks/useInitializationZodI18n';
 import { authConfig } from '@/features/i18n/auth.config';
+import { isValidRedirectPath } from '@/lib/isValidRedirectPath';
 import { DescContent } from '../components/DescContent';
 import { SignForm } from '../components/SignForm';
 import { SocialAuth } from '../components/SocialAuth';
@@ -36,7 +37,7 @@ export const LoginPage = (props: { children?: React.ReactNode | React.ReactNode[
     }
   }, [redirect]);
   const onSuccess = useCallback(() => {
-    if (redirect) {
+    if (redirect && isValidRedirectPath(redirect, window.location.origin)) {
       router.push(redirect);
     } else {
       router.push({

@@ -8,6 +8,7 @@ import type {
 } from 'next';
 import { getUserMe } from '@/backend/api/rest/get-user';
 import { providersAll } from '@/features/auth/components/SocialAuth';
+import { isValidRedirectPath } from './isValidRedirectPath';
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 type GetServerSideProps<
@@ -30,7 +31,8 @@ export default function ensureLogin<P extends { [key: string]: any }>(
       // User is logged in, redirect to home page if on login page
       if (!isAnonymous(user?.id) && isLoginPage) {
         const redirect = context.query.redirect;
-        let destination = typeof redirect === 'string' ? redirect : '/space';
+        let destination =
+          typeof redirect === 'string' && isValidRedirectPath(redirect) ? redirect : '/space';
 
         const via = context.query.via;
         if (typeof via === 'string' && via) {
@@ -95,7 +97,8 @@ export default function ensureLogin<P extends { [key: string]: any }>(
 
 // Redirect to social auth if password login is disabled and only one provider is available
 function redirectSocialAuth(req: GetServerSidePropsContext['req']) {
-  const redirect = new URLSearchParams(req?.url?.split('?')[1] ?? '').get('redirect');
+  const rawRedirect = new URLSearchParams(req?.url?.split('?')[1] ?? '').get('redirect');
+  const redirect = rawRedirect && isValidRedirectPath(rawRedirect) ? rawRedirect : null;
   const envProviders = process.env.SOCIAL_AUTH_PROVIDERS?.split(',') ?? [];
   const envPasswordLoginDisabled = process.env.PASSWORD_LOGIN_DISABLED === 'true';
   if (envPasswordLoginDisabled && envProviders.length === 1) {

@@ -0,0 +1,18 @@
+/**
+ * Validates that a redirect path is safe to navigate to.
+ * Blocks dangerous protocols (javascript:, data:, vbscript:, etc.) and cross-origin redirects.
+ *
+ * @param path - The redirect path to validate
+ * @param origin - The trusted origin to validate against.
+ *   On client: pass `window.location.origin`.
+ *   On server: omit to only allow same-origin relative paths.
+ */
+export function isValidRedirectPath(path: string, origin?: string): boolean {
+  try {
+    const base = origin || 'http://placeholder.local';
+    const url = new URL(path, base);
+    return url.origin === base && (url.protocol === 'http:' || url.protocol === 'https:');
+  } catch {
+    return false;
+  }
+}

@@ -140,7 +140,8 @@ describe('pricing', () => {
         outputTokens: 500,
         webSearches: 2,
       });
-      const expectedUsd = 1000 * 0.0000001 + 500 * 0.0000004 + 2 * 35;
+      // webSearch is USD per 1,000 searches
+      const expectedUsd = 1000 * 0.0000001 + 500 * 0.0000004 + (2 * 35) / 1000;
       expect(credits).toBeCloseTo(expectedUsd / USD_PER_CREDIT);
     });
 
@@ -399,7 +400,8 @@ describe('pricing', () => {
         outputTokens: 1000,
         webSearches: 1,
       });
-      const usd = 5000 * 0.0000001 + 1000 * 0.0000004 + 1 * 35;
+      // webSearch is USD per 1,000 searches
+      const usd = 5000 * 0.0000001 + 1000 * 0.0000004 + (1 * 35) / 1000;
       expect(credits).toBeCloseTo(usd / USD_PER_CREDIT);
     });
   });