MervinPraison/PraisonAI

0 Fork 0

mirror of https://github.com/MervinPraison/PraisonAI.git synced 2026-11-09 11:51:37 -10:00

Files

T

History

3ac10ab851 fix: broken test and in-function shlex imports from CWE-78 remediation (#1322 )

* security: Fix Shell Injection Vulnerabilities (CWE-78) - 15 files fixed

- Replace shell=True with shell=False across subprocess calls
- Add shlex.split() for safe argument parsing
- Update async subprocess calls to use create_subprocess_exec
- Fix vulnerabilities in core, CLI, tools, examples, and tests
- Maintain existing command validation and functionality
- Eliminate 29 shell injection attack vectors

Security improvements:
* Core command execution (execute_command.py)
* Safe shell interface (safe_shell.py)
* Sandbox execution (sandbox_executor.py)
* Workflow and action execution
* Memory hooks and documentation tools
* Example code and test utilities

All functionality preserved while securing against CWE-78 injection attacks.

Fixes #1320

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>

* fix: move import shlex to module level, fix broken test_command_failure

Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/7af9d997-bcd4-48a1-b0fe-5c11679ea3a9

Co-authored-by: MervinPraison <[email protected]>

* fix: address reviewer feedback - shell API contract, cross-platform shlex, exception handling, env validation

- Fix shell=True API contract violation: explicitly reject shell=True with clear error message
- Add cross-platform compatibility for shlex.split() using posix=(os.name == 'posix')
- Add proper exception handling for malformed command syntax (ValueError from shlex.split)
- Add environment variable validation to filter dangerous vars (LD_PRELOAD, PYTHONPATH, etc.)
- Update docstring to indicate shell=True is deprecated for security reasons

Addresses issues raised by Gemini, Qodo, CodeRabbit, and Copilot reviewers.

Co-authored-by: Mervin Praison <[email protected]>

---------

Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>

2026-04-09 06:56:55 +01:00

basic_evaluation_loop.py

Release v4.4.2

2026-02-03 09:15:50 +00:00

multi_step_task_loop.py

Release v4.4.2

2026-02-03 09:15:50 +00:00

README.md

Release v4.4.2

2026-02-03 09:15:50 +00:00

recipe_optimization_loop.py

fix: broken test and in-function shlex imports from CWE-78 remediation (#1322 )

2026-04-09 06:56:55 +01:00

README.md

EvaluationLoop Examples

Examples demonstrating iterative evaluation and improvement patterns.

Quick Start

pip install praisonaiagents
export OPENAI_API_KEY=your-key

Examples

File	Description
`basic_evaluation_loop.py`	Simple loop: Run → Judge → Improve
`multi_step_task_loop.py`	Sequential tasks with context passing
`recipe_optimization_loop.py`	CLI-based recipe optimization

Pattern

┌─────────┐     ┌─────────┐     ┌──────────┐
│  Agent  │ ──► │  Judge  │ ──► │ Feedback │
│  runs   │     │ scores  │     │ improves │
└─────────┘     └─────────┘     └──────────┘
     ▲                               │
     └───────────────────────────────┘
           (repeat until 8.0+)

Run Examples

# Basic loop
python basic_evaluation_loop.py

# Multi-step with context
python multi_step_task_loop.py

# CLI recipe loop
python recipe_optimization_loop.py "research AI trends"