Skip to content

fix(security): Replace eval() with ast.literal_eval() in knowledges.py for safer evaluation#1491

Open
liangzhang-keepmoving wants to merge 1 commit into
TransformerOptimus:mainfrom
liangzhang-keepmoving:fix-security-eval-knowledges
Open

fix(security): Replace eval() with ast.literal_eval() in knowledges.py for safer evaluation#1491
liangzhang-keepmoving wants to merge 1 commit into
TransformerOptimus:mainfrom
liangzhang-keepmoving:fix-security-eval-knowledges

Conversation

@liangzhang-keepmoving
Copy link
Copy Markdown

Security Fix

This PR addresses the security vulnerability in superagi/controllers/knowledges.py where eval() was being used on marketplace-sourced data.

The Problem

The uninstall_selected_knowledge function was using eval() to parse the vector_ids field from marketplace-sourced knowledge configurations. This could allow a malicious marketplace knowledge package to execute arbitrary code when uninstalled.

The Solution

Replaced eval() with ast.literal_eval() which safely evaluates Python literals without executing arbitrary code.

Changes Made

  1. Added import ast at the top of the file
  2. Changed vector_ids = eval(knowledge_config["vector_ids"]) to vector_ids = ast.literal_eval(knowledge_config["vector_ids"])

Testing

The fix maintains the same functionality while providing a safe alternative to eval() for parsing the vector IDs from the knowledge configuration.

This is part of a series of PRs to fix all eval() usage vulnerabilities in the codebase.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant