aljaz/Auto-GPT
1
0
Fork 0
mirror of https://github.com/aljazceru/Auto-GPT.git synced 2025-12-17 05:54:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

security(agent): Replace unsafe pyyaml loader with SafeLoader (#7035)

Browse Source 
Co-authored-by: pixeebot[bot] <104101892+pixeebot[bot]@users.noreply.github.com>
This commit is contained in:
Matheus Oliveira
2024-03-22 10:45:07 -03:00
committed by GitHub
parent 30bc761391
commit a1ffe15142
7 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
autogpts/autogpt/autogpt/commands/file_operations_utils.py
View File

@@ -68,7 +68,7 @@ class XMLParser(ParserStrategy):
# Reading as dictionary and returning string format # Reading as dictionary and returning string format
class YAMLParser(ParserStrategy): class YAMLParser(ParserStrategy):
def read(self, file: BinaryIO) -> str: def read(self, file: BinaryIO) -> str:
data = yaml.load(file, Loader=yaml.FullLoader) data = yaml.load(file, Loader=yaml.SafeLoader)
text = str(data) text = str(data)
return text return text

2
autogpts/autogpt/autogpt/config/ai_directives.py
View File

@@ -32,7 +32,7 @@ class AIDirectives(BaseModel):
raise RuntimeError(f"File validation failed: {message}") raise RuntimeError(f"File validation failed: {message}")
with open(prompt_settings_file, encoding="utf-8") as file: with open(prompt_settings_file, encoding="utf-8") as file:
config_params = yaml.load(file, Loader=yaml.FullLoader) config_params = yaml.load(file, Loader=yaml.SafeLoader)
return AIDirectives( return AIDirectives(
constraints=config_params.get("constraints", []), constraints=config_params.get("constraints", []),

2
autogpts/autogpt/autogpt/config/ai_profile.py
View File

@@ -35,7 +35,7 @@ class AIProfile(BaseModel):
try: try:
with open(ai_settings_file, encoding="utf-8") as file: with open(ai_settings_file, encoding="utf-8") as file:
config_params = yaml.load(file, Loader=yaml.FullLoader) or {} config_params = yaml.load(file, Loader=yaml.SafeLoader) or {}
except FileNotFoundError: except FileNotFoundError:
config_params = {} config_params = {}

2
autogpts/autogpt/autogpt/core/resource/model_providers/openai.py
View File

@@ -257,7 +257,7 @@ class OpenAICredentials(ModelProviderCredentials):
def load_azure_config(self, config_file: Path) -> None: def load_azure_config(self, config_file: Path) -> None:
with open(config_file) as file: with open(config_file) as file:
config_params = yaml.load(file, Loader=yaml.FullLoader) or {} config_params = yaml.load(file, Loader=yaml.SafeLoader) or {}
try: try:
assert config_params.get( assert config_params.get(

2
autogpts/autogpt/autogpt/plugins/plugins_config.py
View File

@@ -72,7 +72,7 @@ class PluginsConfig(BaseModel):
) )
with open(plugins_config_file, "r") as f: with open(plugins_config_file, "r") as f:
plugins_config = yaml.load(f, Loader=yaml.FullLoader) plugins_config = yaml.load(f, Loader=yaml.SafeLoader)
plugins = {} plugins = {}
for name, plugin in plugins_config.items(): for name, plugin in plugins_config.items():

2
autogpts/autogpt/autogpt/utils.py
View File

@@ -7,7 +7,7 @@ from colorama import Fore
def validate_yaml_file(file: str | Path): def validate_yaml_file(file: str | Path):
try: try:
with open(file, encoding="utf-8") as fp: with open(file, encoding="utf-8") as fp:
yaml.load(fp.read(), Loader=yaml.FullLoader) yaml.load(fp.read(), Loader=yaml.SafeLoader)
except FileNotFoundError: except FileNotFoundError:
return (False, f"The file {Fore.CYAN}`{file}`{Fore.RESET} wasn't found") return (False, f"The file {Fore.CYAN}`{file}`{Fore.RESET} wasn't found")
except yaml.YAMLError as e: except yaml.YAMLError as e:

2
autogpts/autogpt/tests/unit/test_plugins.py
View File

@@ -88,7 +88,7 @@ def test_create_base_config(config: Config):
# Check the saved config file # Check the saved config file
with open(config.plugins_config_file, "r") as saved_config_file: with open(config.plugins_config_file, "r") as saved_config_file:
saved_config = yaml.load(saved_config_file, Loader=yaml.FullLoader) saved_config = yaml.load(saved_config_file, Loader=yaml.SafeLoader)
assert saved_config == { assert saved_config == {
"a": {"enabled": True, "config": {}}, "a": {"enabled": True, "config": {}},