Skip to content

Commit 64c317e

Browse files
eyurtseveyurtsev
authored
community: patch graphqa chains (CVE-2024-8309) (#28050)
Patch for CVE-2024-8309 to the v0.2.x branch of langchain https://nvd.nist.gov/vuln/detail/cve-2024-8309
1 parent 76e1dc7 commit 64c317e

File tree

12 files changed

+346
-0
lines changed

12 files changed

+346
-0
lines changed

Diff for: ‎libs/community/langchain_community/chains/graph_qa/arangodb.py

+31
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,37 @@ class ArangoGraphQAChain(Chain):
5757
# Specify the maximum amount of AQL Generation attempts that should be made
5858
max_aql_generation_attempts: int = 3
5959

60+
allow_dangerous_requests: bool = False
61+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
62+
63+
*Security note*: Make sure that the database connection uses credentials
64+
that are narrowly-scoped to only include necessary permissions.
65+
Failure to do so may result in data corruption or loss, since the calling
66+
code may attempt commands that would result in deletion, mutation
67+
of data if appropriately prompted or reading sensitive data if such
68+
data is present in the database.
69+
The best way to guard against such negative outcomes is to (as appropriate)
70+
limit the permissions granted to the credentials used with this tool.
71+
72+
See https://python.langchain.com/docs/security for more information.
73+
"""
74+
75+
def __init__(self, **kwargs: Any) -> None:
76+
"""Initialize the chain."""
77+
super().__init__(**kwargs)
78+
if self.allow_dangerous_requests is not True:
79+
raise ValueError(
80+
"In order to use this chain, you must acknowledge that it can make "
81+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
82+
"You must narrowly scope the permissions of the database connection "
83+
"to only include necessary permissions. Failure to do so may result "
84+
"in data corruption or loss or reading sensitive data if such data is "
85+
"present in the database."
86+
"Only use this chain if you understand the risks and have taken the "
87+
"necessary precautions. "
88+
"See https://python.langchain.com/docs/security for more information."
89+
)
90+
6091
@property
6192
def input_keys(self) -> List[str]:
6293
return [self.input_key]

Diff for: ‎libs/community/langchain_community/chains/graph_qa/cypher.py

+30
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,36 @@ class GraphCypherQAChain(Chain):
180180
"""Optional cypher validation tool"""
181181
use_function_response: bool = False
182182
"""Whether to wrap the database context as tool/function response"""
183+
allow_dangerous_requests: bool = False
184+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
185+
186+
*Security note*: Make sure that the database connection uses credentials
187+
that are narrowly-scoped to only include necessary permissions.
188+
Failure to do so may result in data corruption or loss, since the calling
189+
code may attempt commands that would result in deletion, mutation
190+
of data if appropriately prompted or reading sensitive data if such
191+
data is present in the database.
192+
The best way to guard against such negative outcomes is to (as appropriate)
193+
limit the permissions granted to the credentials used with this tool.
194+
195+
See https://python.langchain.com/docs/security for more information.
196+
"""
197+
198+
def __init__(self, **kwargs: Any) -> None:
199+
"""Initialize the chain."""
200+
super().__init__(**kwargs)
201+
if self.allow_dangerous_requests is not True:
202+
raise ValueError(
203+
"In order to use this chain, you must acknowledge that it can make "
204+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
205+
"You must narrowly scope the permissions of the database connection "
206+
"to only include necessary permissions. Failure to do so may result "
207+
"in data corruption or loss or reading sensitive data if such data is "
208+
"present in the database."
209+
"Only use this chain if you understand the risks and have taken the "
210+
"necessary precautions. "
211+
"See https://python.langchain.com/docs/security for more information."
212+
)
183213

184214
@property
185215
def input_keys(self) -> List[str]:

Diff for: ‎libs/community/langchain_community/chains/graph_qa/falkordb.py

+31
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,37 @@ class FalkorDBQAChain(Chain):
6666
return_direct: bool = False
6767
"""Whether or not to return the result of querying the graph directly."""
6868

69+
allow_dangerous_requests: bool = False
70+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
71+
72+
*Security note*: Make sure that the database connection uses credentials
73+
that are narrowly-scoped to only include necessary permissions.
74+
Failure to do so may result in data corruption or loss, since the calling
75+
code may attempt commands that would result in deletion, mutation
76+
of data if appropriately prompted or reading sensitive data if such
77+
data is present in the database.
78+
The best way to guard against such negative outcomes is to (as appropriate)
79+
limit the permissions granted to the credentials used with this tool.
80+
81+
See https://python.langchain.com/docs/security for more information.
82+
"""
83+
84+
def __init__(self, **kwargs: Any) -> None:
85+
"""Initialize the chain."""
86+
super().__init__(**kwargs)
87+
if self.allow_dangerous_requests is not True:
88+
raise ValueError(
89+
"In order to use this chain, you must acknowledge that it can make "
90+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
91+
"You must narrowly scope the permissions of the database connection "
92+
"to only include necessary permissions. Failure to do so may result "
93+
"in data corruption or loss or reading sensitive data if such data is "
94+
"present in the database."
95+
"Only use this chain if you understand the risks and have taken the "
96+
"necessary precautions. "
97+
"See https://python.langchain.com/docs/security for more information."
98+
)
99+
69100
@property
70101
def input_keys(self) -> List[str]:
71102
"""Return the input keys.

Diff for: ‎libs/community/langchain_community/chains/graph_qa/gremlin.py

+31
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,37 @@ class GremlinQAChain(Chain):
6363
return_direct: bool = False
6464
return_intermediate_steps: bool = False
6565

66+
allow_dangerous_requests: bool = False
67+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
68+
69+
*Security note*: Make sure that the database connection uses credentials
70+
that are narrowly-scoped to only include necessary permissions.
71+
Failure to do so may result in data corruption or loss, since the calling
72+
code may attempt commands that would result in deletion, mutation
73+
of data if appropriately prompted or reading sensitive data if such
74+
data is present in the database.
75+
The best way to guard against such negative outcomes is to (as appropriate)
76+
limit the permissions granted to the credentials used with this tool.
77+
78+
See https://python.langchain.com/docs/security for more information.
79+
"""
80+
81+
def __init__(self, **kwargs: Any) -> None:
82+
"""Initialize the chain."""
83+
super().__init__(**kwargs)
84+
if self.allow_dangerous_requests is not True:
85+
raise ValueError(
86+
"In order to use this chain, you must acknowledge that it can make "
87+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
88+
"You must narrowly scope the permissions of the database connection "
89+
"to only include necessary permissions. Failure to do so may result "
90+
"in data corruption or loss or reading sensitive data if such data is "
91+
"present in the database."
92+
"Only use this chain if you understand the risks and have taken the "
93+
"necessary precautions. "
94+
"See https://python.langchain.com/docs/security for more information."
95+
)
96+
6697
@property
6798
def input_keys(self) -> List[str]:
6899
"""Input keys.

Diff for: ‎libs/community/langchain_community/chains/graph_qa/hugegraph.py

+31
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,37 @@ class HugeGraphQAChain(Chain):
3939
input_key: str = "query" #: :meta private:
4040
output_key: str = "result" #: :meta private:
4141

42+
allow_dangerous_requests: bool = False
43+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
44+
45+
*Security note*: Make sure that the database connection uses credentials
46+
that are narrowly-scoped to only include necessary permissions.
47+
Failure to do so may result in data corruption or loss, since the calling
48+
code may attempt commands that would result in deletion, mutation
49+
of data if appropriately prompted or reading sensitive data if such
50+
data is present in the database.
51+
The best way to guard against such negative outcomes is to (as appropriate)
52+
limit the permissions granted to the credentials used with this tool.
53+
54+
See https://python.langchain.com/docs/security for more information.
55+
"""
56+
57+
def __init__(self, **kwargs: Any) -> None:
58+
"""Initialize the chain."""
59+
super().__init__(**kwargs)
60+
if self.allow_dangerous_requests is not True:
61+
raise ValueError(
62+
"In order to use this chain, you must acknowledge that it can make "
63+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
64+
"You must narrowly scope the permissions of the database connection "
65+
"to only include necessary permissions. Failure to do so may result "
66+
"in data corruption or loss or reading sensitive data if such data is "
67+
"present in the database."
68+
"Only use this chain if you understand the risks and have taken the "
69+
"necessary precautions. "
70+
"See https://python.langchain.com/docs/security for more information."
71+
)
72+
4273
@property
4374
def input_keys(self) -> List[str]:
4475
"""Input keys.

Diff for: ‎libs/community/langchain_community/chains/graph_qa/kuzu.py

+31
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,37 @@ class KuzuQAChain(Chain):
7373
input_key: str = "query" #: :meta private:
7474
output_key: str = "result" #: :meta private:
7575

76+
allow_dangerous_requests: bool = False
77+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
78+
79+
*Security note*: Make sure that the database connection uses credentials
80+
that are narrowly-scoped to only include necessary permissions.
81+
Failure to do so may result in data corruption or loss, since the calling
82+
code may attempt commands that would result in deletion, mutation
83+
of data if appropriately prompted or reading sensitive data if such
84+
data is present in the database.
85+
The best way to guard against such negative outcomes is to (as appropriate)
86+
limit the permissions granted to the credentials used with this tool.
87+
88+
See https://python.langchain.com/docs/security for more information.
89+
"""
90+
91+
def __init__(self, **kwargs: Any) -> None:
92+
"""Initialize the chain."""
93+
super().__init__(**kwargs)
94+
if self.allow_dangerous_requests is not True:
95+
raise ValueError(
96+
"In order to use this chain, you must acknowledge that it can make "
97+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
98+
"You must narrowly scope the permissions of the database connection "
99+
"to only include necessary permissions. Failure to do so may result "
100+
"in data corruption or loss or reading sensitive data if such data is "
101+
"present in the database."
102+
"Only use this chain if you understand the risks and have taken the "
103+
"necessary precautions. "
104+
"See https://python.langchain.com/docs/security for more information."
105+
)
106+
76107
@property
77108
def input_keys(self) -> List[str]:
78109
"""Return the input keys.

Diff for: ‎libs/community/langchain_community/chains/graph_qa/nebulagraph.py

+31
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,37 @@ class NebulaGraphQAChain(Chain):
3939
input_key: str = "query" #: :meta private:
4040
output_key: str = "result" #: :meta private:
4141

42+
allow_dangerous_requests: bool = False
43+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
44+
45+
*Security note*: Make sure that the database connection uses credentials
46+
that are narrowly-scoped to only include necessary permissions.
47+
Failure to do so may result in data corruption or loss, since the calling
48+
code may attempt commands that would result in deletion, mutation
49+
of data if appropriately prompted or reading sensitive data if such
50+
data is present in the database.
51+
The best way to guard against such negative outcomes is to (as appropriate)
52+
limit the permissions granted to the credentials used with this tool.
53+
54+
See https://python.langchain.com/docs/security for more information.
55+
"""
56+
57+
def __init__(self, **kwargs: Any) -> None:
58+
"""Initialize the chain."""
59+
super().__init__(**kwargs)
60+
if self.allow_dangerous_requests is not True:
61+
raise ValueError(
62+
"In order to use this chain, you must acknowledge that it can make "
63+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
64+
"You must narrowly scope the permissions of the database connection "
65+
"to only include necessary permissions. Failure to do so may result "
66+
"in data corruption or loss or reading sensitive data if such data is "
67+
"present in the database."
68+
"Only use this chain if you understand the risks and have taken the "
69+
"necessary precautions. "
70+
"See https://python.langchain.com/docs/security for more information."
71+
)
72+
4273
@property
4374
def input_keys(self) -> List[str]:
4475
"""Return the input keys.

Diff for: ‎libs/community/langchain_community/chains/graph_qa/neptune_cypher.py

+31
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,37 @@ class NeptuneOpenCypherQAChain(Chain):
120120
extra_instructions: Optional[str] = None
121121
"""Extra instructions by the appended to the query generation prompt."""
122122

123+
allow_dangerous_requests: bool = False
124+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
125+
126+
*Security note*: Make sure that the database connection uses credentials
127+
that are narrowly-scoped to only include necessary permissions.
128+
Failure to do so may result in data corruption or loss, since the calling
129+
code may attempt commands that would result in deletion, mutation
130+
of data if appropriately prompted or reading sensitive data if such
131+
data is present in the database.
132+
The best way to guard against such negative outcomes is to (as appropriate)
133+
limit the permissions granted to the credentials used with this tool.
134+
135+
See https://python.langchain.com/docs/security for more information.
136+
"""
137+
138+
def __init__(self, **kwargs: Any) -> None:
139+
"""Initialize the chain."""
140+
super().__init__(**kwargs)
141+
if self.allow_dangerous_requests is not True:
142+
raise ValueError(
143+
"In order to use this chain, you must acknowledge that it can make "
144+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
145+
"You must narrowly scope the permissions of the database connection "
146+
"to only include necessary permissions. Failure to do so may result "
147+
"in data corruption or loss or reading sensitive data if such data is "
148+
"present in the database."
149+
"Only use this chain if you understand the risks and have taken the "
150+
"necessary precautions. "
151+
"See https://python.langchain.com/docs/security for more information."
152+
)
153+
123154
@property
124155
def input_keys(self) -> List[str]:
125156
"""Return the input keys.

Diff for: ‎libs/community/langchain_community/chains/graph_qa/neptune_sparql.py

+31
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,37 @@ class NeptuneSparqlQAChain(Chain):
113113
extra_instructions: Optional[str] = None
114114
"""Extra instructions by the appended to the query generation prompt."""
115115

116+
allow_dangerous_requests: bool = False
117+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
118+
119+
*Security note*: Make sure that the database connection uses credentials
120+
that are narrowly-scoped to only include necessary permissions.
121+
Failure to do so may result in data corruption or loss, since the calling
122+
code may attempt commands that would result in deletion, mutation
123+
of data if appropriately prompted or reading sensitive data if such
124+
data is present in the database.
125+
The best way to guard against such negative outcomes is to (as appropriate)
126+
limit the permissions granted to the credentials used with this tool.
127+
128+
See https://python.langchain.com/docs/security for more information.
129+
"""
130+
131+
def __init__(self, **kwargs: Any) -> None:
132+
"""Initialize the chain."""
133+
super().__init__(**kwargs)
134+
if self.allow_dangerous_requests is not True:
135+
raise ValueError(
136+
"In order to use this chain, you must acknowledge that it can make "
137+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
138+
"You must narrowly scope the permissions of the database connection "
139+
"to only include necessary permissions. Failure to do so may result "
140+
"in data corruption or loss or reading sensitive data if such data is "
141+
"present in the database."
142+
"Only use this chain if you understand the risks and have taken the "
143+
"necessary precautions. "
144+
"See https://python.langchain.com/docs/security for more information."
145+
)
146+
116147
@property
117148
def input_keys(self) -> List[str]:
118149
return [self.input_key]

Diff for: ‎libs/community/langchain_community/chains/graph_qa/ontotext_graphdb.py

+31
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,37 @@ class OntotextGraphDBQAChain(Chain):
4646
input_key: str = "query" #: :meta private:
4747
output_key: str = "result" #: :meta private:
4848

49+
allow_dangerous_requests: bool = False
50+
"""Forced user opt-in to acknowledge that the chain can make dangerous requests.
51+
52+
*Security note*: Make sure that the database connection uses credentials
53+
that are narrowly-scoped to only include necessary permissions.
54+
Failure to do so may result in data corruption or loss, since the calling
55+
code may attempt commands that would result in deletion, mutation
56+
of data if appropriately prompted or reading sensitive data if such
57+
data is present in the database.
58+
The best way to guard against such negative outcomes is to (as appropriate)
59+
limit the permissions granted to the credentials used with this tool.
60+
61+
See https://python.langchain.com/docs/security for more information.
62+
"""
63+
64+
def __init__(self, **kwargs: Any) -> None:
65+
"""Initialize the chain."""
66+
super().__init__(**kwargs)
67+
if self.allow_dangerous_requests is not True:
68+
raise ValueError(
69+
"In order to use this chain, you must acknowledge that it can make "
70+
"dangerous requests by setting `allow_dangerous_requests` to `True`."
71+
"You must narrowly scope the permissions of the database connection "
72+
"to only include necessary permissions. Failure to do so may result "
73+
"in data corruption or loss or reading sensitive data if such data is "
74+
"present in the database."
75+
"Only use this chain if you understand the risks and have taken the "
76+
"necessary precautions. "
77+
"See https://python.langchain.com/docs/security for more information."
78+
)
79+
4980
@property
5081
def input_keys(self) -> List[str]:
5182
return [self.input_key]

0 commit comments

Comments
 (0)