Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/startup sh linefeed issue #1483

Closed

Conversation

draktheas
Copy link

@draktheas draktheas commented Dec 17, 2024


Important

Enhances security by introducing restricted modules, updates library management, and fixes a linefeed issue in the startup script.

  • Security Enhancements:
    • Introduced restricted modules (restricted_base64, restricted_datetime, restricted_json, restricted_matplotlib, restricted_numpy, restricted_pandas, restricted_seaborn) to prevent unauthorized access and execution of potentially harmful code.
    • Updated _is_malicious_code() in code_cleaning.py to check for restricted library access and private attribute usage.
    • Added tests in test_code_cleaning.py to ensure restricted access and imports are handled correctly.
  • Library Management:
    • Updated WHITELISTED_LIBRARIES and RESTRICTED_LIBS in constants.py to reflect new security measures.
    • Modified get_environment() in optional.py to use restricted modules.
  • Documentation:
    • Updated custom-whitelisted-dependencies.mdx and library.mdx to reflect changes in library management and security practices.
  • Miscellaneous:
    • Fixed linefeed issue in startup.sh in Dockerfile.
    • Minor refactoring in response_parser.py to handle DataFrame conversion.

This description was created by Ellipsis for b809841. It will automatically update as commits are pushed.

AlessandroMarc and others added 10 commits October 18, 2024 20:06
Add 's' in the end of keyword "clarification_question"

agent.clarification_question('What is the GDP of the United States?')
…#1417)

* Add /app to PYTHONPATH

* fix for issue Sinaptik-AI#1415

---------

Co-authored-by: Giuseppe Coco <[email protected]>
Add documentation of how to use pandasai.json file
Sinaptik-AI#1432)

* fix[output_format]: accept dataframe dict as output and secure sql query execution

* fix: ruff errors
…aptik-AI#1429)

* chore[Security]: restrict libs to allow specific functionalities

* remove: extra lib handling

* fix: ruff errors

* fix: error message for bad import

* fix: add io library in the blacklist
@dosubot dosubot bot added the size:XXL This PR changes 1000+ lines, ignoring generated files. label Dec 17, 2024
Copy link

@ellipsis-dev ellipsis-dev bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 Looks good to me! Reviewed everything up to b809841 in 1 minute and 52 seconds

More details
  • Looked at 1560 lines of code in 28 files
  • Skipped 1 files when reviewing.
  • Skipped posting 1 drafted comments based on config settings.
1. pandasai/connectors/sql.py:442
  • Draft comment:
    The error message "Malicious query is generated in code" is not clear. Consider rephrasing it to something like:
            raise MaliciousQueryError("The generated SQL query is potentially malicious and has been blocked.")
  • Reason this comment was not posted:
    Comment was on unchanged code.

Workflow ID: wflow_EAXiGSgluR2UOlmv


You can customize Ellipsis with 👍 / 👎 feedback, review rules, user-specific overrides, quiet mode, and more.

@draktheas draktheas closed this Dec 17, 2024
@draktheas draktheas deleted the fix/startup_sh_linefeed_issue branch December 18, 2024 00:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
size:XXL This PR changes 1000+ lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants