AI/ragflow
1
0
Fork 0
mirror of https://git.mirrors.martin98.com/https://github.com/infiniflow/ragflow.git synced 2025-08-12 10:09:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

Remove usage of eval() from postprocess.py (#4571)

Browse Source 
Remove usage of `eval()` from postprocess.py

### What problem does this PR solve?

The use of `eval()` is a potential security risk. While the use of
`eval()` is guarded and thus not a security risk normally, `assert`s
aren't run if `-O` or `-OO` is passed to the interpreter, and as such
then the guard would not apply. In any case there is no reason to use
`eval()` here at all.

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)
- [x] Other (please describe):

Potential security fix if somehow the passed `modul_name` could be user
controlled.
This commit is contained in:
Mathias Panzenböck 2025-01-22 12:37:24 +01:00 committed by GitHub
parent 336e5fb37f
commit 1a367664f1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
deepdoc/vision/postprocess.py
View File

@ -23,7 +23,7 @@ import pyclipper
def build_post_process(config, global_config=None): def build_post_process(config, global_config=None):
support_dict = ['DBPostProcess', 'CTCLabelDecode'] support_dict = {'DBPostProcess': DBPostProcess, 'CTCLabelDecode': CTCLabelDecode}
config = copy.deepcopy(config) config = copy.deepcopy(config)
module_name = config.pop('name') module_name = config.pop('name')
@ -31,10 +31,11 @@ def build_post_process(config, global_config=None):
return return
if global_config is not None: if global_config is not None:
config.update(global_config) config.update(global_config)
assert module_name in support_dict, Exception( module_class = support_dict.get(module_name)
'post process only support {}'.format(support_dict)) if module_class is None:
module_class = eval(module_name)(**config) raise ValueError(
return module_class 'post process only support {}'.format(list(support_dict)))
return module_class(**config)
class DBPostProcess(object): class DBPostProcess(object):