Skip to content

Conversation

juanmichelini
Copy link
Contributor

Changed eval call for ast.literal_eval call to fix Vulnerability report.

  • This change is worth documenting at https://docs.all-hands.dev/
  • Include this change in the Release Notes. If checked, you must provide an end-user friendly description for your change below

End-user friendly description of the problem this fixes or functionality this introduces.


Summarize what the PR does, explaining any non-trivial design decisions.


Link of any specific issues this addresses:

Copy link
Collaborator

@xingyaoww xingyaoww left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually i think this probably won't work since this is intentionally executing code

@juanmichelini
Copy link
Contributor Author

Actually i think this probably won't work since this is intentionally executing code

my bad, took the comment
# Converting the string answer to a number/list/bool/option
literlly.

I understand then that it is executing code like 1+2, and then converts it to 3?

Copy link
Collaborator

@xingyaoww xingyaoww left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh my bad, actually look through this again, @juanmichelini you are probably right 😭

@xingyaoww xingyaoww enabled auto-merge (squash) October 7, 2025 19:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants