infiniflow/ragflow · error · Exception

Database host '{self._param.host}' is not allowed: {e}

Error message

Database host '{self._param.host}' is not allowed: {e}

What it means

Error "Database host '{self._param.host}' is not allowed: {e}" thrown in infiniflow/ragflow.

Source

Thrown at agent/tools/exesql.py:127

                except Exception:
                    args[k] = str(args[k])
            self.set_input_value(k, args[k])
        sql = self.string_format(sql, args)

        if self.check_if_canceled("ExeSQL processing"):
            return

        # The DB host/port are node-author-controlled and are connected to
        # server-side, so guard against SSRF (internal hosts, loopback, cloud
        # metadata) the same way the `test_db_connection` endpoint does. Connect
        # to the validated, resolved public IP so a later DNS change cannot
        # rebind the host to an internal address (mirrors agent_api.py).
        logging.info(f"ExeSQL validating database host: {self._param.host}")
        try:
            safe_host = assert_host_is_safe(self._param.host)
        except ValueError as e:
            logging.warning(f"ExeSQL rejected database host {self._param.host}: {e}")
            raise Exception(f"Database host '{self._param.host}' is not allowed: {e}")
        logging.info(f"ExeSQL validated database host {self._param.host} -> {safe_host}")

        sqls = sql.split(";")
        if self._param.db_type in ["mysql", "mariadb"]:
            db = pymysql.connect(db=self._param.database, user=self._param.username, host=safe_host, port=self._param.port, password=self._param.password)
        elif self._param.db_type == "oceanbase":
            db = pymysql.connect(db=self._param.database, user=self._param.username, host=safe_host, port=self._param.port, password=self._param.password, charset="utf8mb4")
        elif self._param.db_type == "postgres":
            db = psycopg2.connect(dbname=self._param.database, user=self._param.username, host=safe_host, port=self._param.port, password=self._param.password)
        elif self._param.db_type == "mssql":
            conn_str = (
                r"DRIVER={ODBC Driver 17 for SQL Server};"
                r"SERVER=" + safe_host + "," + str(self._param.port) + ";"
                r"DATABASE=" + self._param.database + ";"
                r"UID=" + self._param.username + ";"
                r"PWD=" + self._param.password
            )
            db = pyodbc.connect(conn_str)

View on GitHub (pinned to 554fb1133a)

Solutions

1. Use a database host that is permitted by the allowlist/SSRF policy.
2. If the host is legitimate, add it to the allowed hosts configuration.

Example fix

host = 'db.internal.example.com'  # allowed host, not 127.0.0.1 or metadata IPs

When it happens

Trigger: Thrown at agent/tools/exesql.py:127 when the library encounters an invalid state.

Common situations: The configured database host resolves to a blocked address (loopback, link-local, or cloud metadata endpoints) under the SSRF guard; using an allowed host prevents this error.

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/9ec60961c51a86ac. Report an issue: GitHub.