wizata-dsapi 2.1.0.dev5__tar.gz → 2.1.0.dev6__tar.gz

{wizata_dsapi-2.1.0.dev5 → wizata_dsapi-2.1.0.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wizata_dsapi
-Version: 2.1.0.dev5
+Version: 2.1.0.dev6
 Summary: Wizata Data Science Toolkit
 Author: Wizata S.A.
 Author-email: info@wizata.com

{wizata_dsapi-2.1.0.dev5 → wizata_dsapi-2.1.0.dev6}/wizata_dsapi/scripts/common.py

@@ -323,10 +323,24 @@ def formula(context: wizata_dsapi.Context):
     expression = context.properties["expression"]
     result = context.properties.get("result", "result")
 
-    # Whitelist validation: strip everything we allow, flag any leftover token.
-    sanitized = expression
-    for col in sorted(df.columns, key=len, reverse=True):
-        sanitized = sanitized.replace(f"`{col}`", "").replace(col, "")
+    # Replace every column name (backticked or bare) with a safe placeholder
+    # identifier before evaluation. Column names can contain characters that
+    # are illegal in a Python/pandas eval expression — e.g. tag IDs like
+    # 'DE_AL_Ark1_1:04800F1?Value', whose numeric segment '04800' is otherwise
+    # parsed as a leading-zero integer literal and raises a SyntaxError
+    # (DEV-5912). Substituting the whole name atomically sidesteps this.
+    placeholders = {}  # placeholder -> real column name
+    substituted = expression
+    for i, col in enumerate(sorted(df.columns, key=len, reverse=True)):
+        placeholder = f"__wz_col_{i}__"
+        substituted = substituted.replace(f"`{col}`", placeholder).replace(col, placeholder)
+        placeholders[placeholder] = col
+
+    # Whitelist validation: strip placeholders + allowed functions, flag any
+    # leftover token as disallowed.
+    sanitized = substituted
+    for placeholder in placeholders:
+        sanitized = sanitized.replace(placeholder, "")
     for fn in _FORMULA_SAFE_FUNCTIONS:
         sanitized = sanitized.replace(fn, "")
     sanitized = re.sub(r"[\d\.\+\-\*/\%\(\)\s,\^]", "", sanitized)
@@ -337,7 +351,9 @@ def formula(context: wizata_dsapi.Context):
             f"{list(_FORMULA_SAFE_FUNCTIONS.keys())}"
         )
 
-    df[result] = df.eval(expression, local_dict=_FORMULA_SAFE_FUNCTIONS, engine="python")
+    # Evaluate against a frame whose columns are the safe placeholder names.
+    safe_df = df.rename(columns={real: ph for ph, real in placeholders.items()})
+    df[result] = safe_df.eval(substituted, local_dict=_FORMULA_SAFE_FUNCTIONS, engine="python")
     return df
 
 

wizata_dsapi-2.1.0.dev6/wizata_dsapi/version.py

@@ -0,0 +1 @@
+__version__ = "2.1.0.dev6"

{wizata_dsapi-2.1.0.dev5 → wizata_dsapi-2.1.0.dev6}/wizata_dsapi.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wizata_dsapi
-Version: 2.1.0.dev5
+Version: 2.1.0.dev6
 Summary: Wizata Data Science Toolkit
 Author: Wizata S.A.
 Author-email: info@wizata.com

wizata_dsapi-2.1.0.dev5/wizata_dsapi/version.py

@@ -1 +0,0 @@
-__version__ = "2.1.0.dev5"