Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix two security issues #1122

Merged
merged 7 commits into from
Jan 8, 2024
Merged

Fix two security issues #1122

merged 7 commits into from
Jan 8, 2024

Conversation

YusukeJustinNakajima
Copy link
Contributor

@YusukeJustinNakajima YusukeJustinNakajima commented Jan 6, 2024

Description

Fixed below functions

  • openapi.py
    • Fix yaml.load function argument to prevent arbitrary code execution
  • json.py
    • Added character length limitation to fix ReDoS issue

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Refactor (does not change functionality, e.g. code style improvements, linting)
  • Documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

Please delete options that are not relevant.

  • Unit Test
  • Test Script (please provide)

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules
  • I have checked my code and corrected any misspellings

Maintainer Checklist

  • closes #xxxx (Replace xxxx with the GitHub issue number)
  • Made sure Checks passed

@dosubot dosubot bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Jan 6, 2024
@YusukeJustinNakajima
Copy link
Contributor Author

YusukeJustinNakajima commented Jan 6, 2024

@deshraj
I have fixed the security issue that I communicated to you via email. It would be very helpful if you could give priority to this issue. Also, although I have indicated that it is a "Refactor" this time, it would be better if you could make it clear that it is a security issue.

@YusukeJustinNakajima YusukeJustinNakajima changed the title Change to safe yaml load function Fix two security issues Jan 6, 2024
@dosubot dosubot bot added the lgtm This PR has been approved by a maintainer label Jan 7, 2024
Copy link

codecov bot commented Jan 7, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (295cd3f) 57.82% compared to head (3e908a0) 56.06%.
Report is 21 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1122      +/-   ##
==========================================
- Coverage   57.82%   56.06%   -1.77%     
==========================================
  Files         131      134       +3     
  Lines        5141     5372     +231     
==========================================
+ Hits         2973     3012      +39     
- Misses       2168     2360     +192     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

embedchain/loaders/json.py Outdated Show resolved Hide resolved
@dosubot dosubot bot removed the lgtm This PR has been approved by a maintainer label Jan 7, 2024
embedchain/loaders/json.py Outdated Show resolved Hide resolved
@dosubot dosubot bot added the lgtm This PR has been approved by a maintainer label Jan 8, 2024
@deshraj deshraj merged commit f7696d1 into mem0ai:main Jan 8, 2024
4 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
lgtm This PR has been approved by a maintainer size:XS This PR changes 0-9 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants