Close SSRF gap where compare_extraction fetched via newspaper3k and
requests.get without _validate_url, unlike the trafilatura path.
Co-authored-by: Mervin Praison <[email protected]>
_validate_url only inspected IP literals, so a plain domain or an encoded
form (a decimal IP, or "<internal-ip>.nip.io") passed even though it
resolves to an internal address, defeating the SSRF guard. Resolve the
hostname and reject any private, loopback, reserved or link-local address,
matching praisonaiagents/tools/file_tools.py.
* feat: add JIRA Agent watch tools for monitoring issues and projects
- Add jira_tools.py with 4 comprehensive JIRA monitoring tools
- jira_watch_issue: Monitor specific issues for real-time changes
- jira_watch_project: Watch projects for new and updated issues
- jira_get_issue_info: Get detailed issue information
- jira_search_issues: Search using JQL queries
- Support both cloud and server JIRA authentication
- Include comprehensive unit tests and usage example
- Follow protocol-driven architecture with @tool decorator
- Implement lazy imports and proper error handling
Co-authored-by: MervinPraison <[email protected]>
* fix: resolve critical JIRA tools issues - blocking sleep, data loss, injection, mocking
- Replace blocking time.sleep() polling with timestamp-based single-shot checks
- Fix silent comment data loss by tracking comments independently
- Add project key validation to prevent JQL injection attacks
- Fix test mocking to use correct patch target (jira.JIRA)
- Remove unused variables and improve code quality
- Update tests for new non-blocking API
Fixes blocking agent execution and security vulnerabilities identified by reviewers.
Co-authored-by: Mervin Praison <[email protected]>
* fix: resolve critical JIRA tools issues - string timestamp comparison, JQL injection, null safety
- Added _parse_timestamp() helper to properly parse ISO 8601 timestamps into datetime objects
- Added _validate_timestamp() to prevent JQL injection through timestamp parameters
- Fixed all timestamp comparisons to use datetime objects instead of string comparisons
- Added null safety checks for all JIRA API fields (author, creator, reporter)
- Removed unnecessary expand parameter from jira_get_issue_info
- Added comprehensive unit tests for timestamp parsing utilities
Addresses issues identified by Gemini, Greptile, and other reviewers
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
- Remove Trafilatura from core praisonaiagents package
- Create custom tool implementation in examples/python/tools/
- Update example to demonstrate custom tool usage with agents
- Remove dependencies from pyproject.toml
- Remove from tools __init__.py and README.md
- Keep all functionality as standalone custom tool
This change follows the request to not integrate into core package
but provide as custom tool example instead.
Co-authored-by: Mervin Praison <[email protected]>
- Fix asyncio blocking by using asyncio.to_thread() for all synchronous calls in async functions
- Remove dead code: module-level __call__ function that would never be invoked
- Replace global variable with module-level trafilatura import for cleaner code
- Remove unused json import in test file
- Improve error detection from fragile string check to robust pattern
- Add clarifying comments about safe circular imports due to lazy loading
Co-authored-by: Mervin Praison <[email protected]>
- Implement SearxNG search tool following PraisonAI patterns
- Add comprehensive documentation with setup instructions
- Include working examples for both tools and agents
- Support configurable SearxNG URL and search parameters
- Integrate with existing tools registry and documentation
- Provide privacy-focused alternative to traditional search engines
Addresses issue #337
Co-authored-by: MervinPraison <[email protected]>
