langroid 0.53.4__py3-none-any.whl → 0.53.5__py3-none-any.whl

langroid/agent/xml_tool_message.py

@@ -49,11 +49,11 @@ class XMLToolMessage(ToolMessage):
         Raises:
             etree.XMLSyntaxError: If the input string is not valid XML.
         """
-        # SECURITY: Initialize XMLParser with flags to prevent 
-        # XML External Entity (XXE), billion laughs, and external DTD attacks by 
+        # SECURITY: Initialize XMLParser with flags to prevent
+        # XML External Entity (XXE), billion laughs, and external DTD attacks by
         # disabling entity resolution, DTD loading, and network access;
         # `strip_cdata=False` is needed to preserve
-        # content within CDATA sections (e.g., for code).        
+        # content within CDATA sections (e.g., for code).
         parser = etree.XMLParser(
             strip_cdata=False,
             resolve_entities=False,

langroid/vector_store/base.py

@@ -159,12 +159,11 @@ class VectorStore(ABC):
         df = pd.DataFrame(dicts)
 
         try:
-            result = pd.eval(  # safer than eval but limited to single expression
-                calc,
-                engine="python",
-                parser="pandas",
-                local_dict={"df": df},
-            )
+            # SECURITY: Use Python's eval() with NO globals and only {"df": df}
+            # in locals. This allows pandas operations on `df` while preventing
+            # access to builtins or other potentially harmful global functions,
+            # mitigating risks associated with executing untrusted `calc` strings.
+            result = eval(calc, {}, {"df": df})  # type: ignore
         except Exception as e:
             # return error message so LLM can fix the calc string if needed
             err = f"""

{langroid-0.53.4.dist-info → langroid-0.53.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langroid
-Version: 0.53.4
+Version: 0.53.5
 Summary: Harness LLMs with Multi-Agent Programming
 Author-email: Prasad Chalasani <pchalasani@gmail.com>
 License: MIT

{langroid-0.53.4.dist-info → langroid-0.53.5.dist-info}/RECORD

@@ -10,7 +10,7 @@ langroid/agent/chat_document.py,sha256=6O20Fp4QrquykaF2jFtwNHkvcoDte1LLwVZNk9mVH
 langroid/agent/openai_assistant.py,sha256=JkAcs02bIrgPNVvUWVR06VCthc5-ulla2QMBzux_q6o,34340
 langroid/agent/task.py,sha256=HB6N-Jn80HFqCf0ZYOC1v3Bn3oO7NLjShHQJJFwW0q4,90557
 langroid/agent/tool_message.py,sha256=BhjP-_TfQ2tgxuY4Yo_JHLOwwt0mJ4BwjPnREvEY4vk,14744
-langroid/agent/xml_tool_message.py,sha256=Yf-OsqO6z17qgQbfcTX4dxmPMtwYZVfgcWjcWI8nJzE,15506
+langroid/agent/xml_tool_message.py,sha256=oeBKnJNoGaKdtz39XoWGMTNlVyXew2MWH5lgtYeh8wQ,15496
 langroid/agent/callbacks/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 langroid/agent/callbacks/chainlit.py,sha256=UHB6P_J40vsVnssosqkpkOVWRf9NK4TOY0_G2g_Arsg,20900
 langroid/agent/special/__init__.py,sha256=gik_Xtm_zV7U9s30Mn8UX3Gyuy4jTjQe9zjiE3HWmEo,1273
@@ -124,7 +124,7 @@ langroid/utils/output/citations.py,sha256=9W0slQQgzRGLS7hU51mm5UWao5cS_xr8AVosVe
 langroid/utils/output/printing.py,sha256=yzPJZN-8_jyOJmI9N_oLwEDfjMwVgk3IDiwnZ4eK_AE,2962
 langroid/utils/output/status.py,sha256=rzbE7mDJcgNNvdtylCseQcPGCGghtJvVq3lB-OPJ49E,1049
 langroid/vector_store/__init__.py,sha256=8ktJUVsVUoc7FMmkUFpFBZu7VMWUqQY9zpm4kEJ8yTs,1537
-langroid/vector_store/base.py,sha256=sT6_8-LfLu_z82p4yMmyH_Kh8kt7o51Lt1n00PKBXWw,14588
+langroid/vector_store/base.py,sha256=HDgY2uMwOnoyuySDCXdRK_USPWaFRLhti94B2OP1B_w,14752
 langroid/vector_store/chromadb.py,sha256=p9mEqJwO2BrL2jSSXfa23kCPlPOwWpF3xJYd5zoWw_c,8661
 langroid/vector_store/lancedb.py,sha256=Qd20gKjWozPWfW5-D66J6U8dSrJo1yl-maj6s1lbf1c,14688
 langroid/vector_store/meilisearch.py,sha256=6frB7GFWeWmeKzRfLZIvzRjllniZ1cYj3HmhHQICXLs,11663
@@ -132,7 +132,7 @@ langroid/vector_store/pineconedb.py,sha256=otxXZNaBKb9f_H75HTaU3lMHiaR2NUp5MqwLZ
 langroid/vector_store/postgres.py,sha256=wHPtIi2qM4fhO4pMQr95pz1ZCe7dTb2hxl4VYspGZoA,16104
 langroid/vector_store/qdrantdb.py,sha256=O6dSBoDZ0jzfeVBd7LLvsXu083xs2fxXtPa9gGX3JX4,18443
 langroid/vector_store/weaviatedb.py,sha256=Yn8pg139gOy3zkaPfoTbMXEEBCiLiYa1MU5d_3UA1K4,11847
-langroid-0.53.4.dist-info/METADATA,sha256=mJijMq7-4U64bl-XA2rQiGdgW6A3TxdMMx60sa-E1Fc,64945
-langroid-0.53.4.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-langroid-0.53.4.dist-info/licenses/LICENSE,sha256=EgVbvA6VSYgUlvC3RvPKehSg7MFaxWDsFuzLOsPPfJg,1065
-langroid-0.53.4.dist-info/RECORD,,
+langroid-0.53.5.dist-info/METADATA,sha256=ExVMihbLql8jTdQQ-6DuM8Ocjyqc0JV057Sp17U3y8Y,64945
+langroid-0.53.5.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+langroid-0.53.5.dist-info/licenses/LICENSE,sha256=EgVbvA6VSYgUlvC3RvPKehSg7MFaxWDsFuzLOsPPfJg,1065
+langroid-0.53.5.dist-info/RECORD,,