WEBDIENSTE/langgraph
1
0
Fork 0
mirror of https://github.com/langchain-ai/langgraph.git synced 2026-08-30 03:39:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore: Restrict "json" type deserialization (#6269)

Browse Source 
- Rm untyped loads/dumps
- Restrict to an allow list

---------

Co-authored-by: Sydney Runkle <sydneymarierunkle@gmail.com>
This commit is contained in:
William FH
2025-10-20 10:18:36 -07:00
committed by GitHub
co-authored by Sydney Runkle
parent d298b489b4
commit c5744f583b
8 changed files with 143 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libs/checkpoint-sqlite/langgraph/checkpoint/sqlite/__init__.py
+6 -9
View File
@@ -1,5 +1,6 @@
from __future__ import annotations
import json
import random
import sqlite3
import threading
@@ -265,9 +266,7 @@ class SqliteSaver(BaseCheckpointSaver[str]):
self.serde.loads_typed((type, checkpoint)),
cast(
CheckpointMetadata,
self.jsonplus_serde.loads(metadata)
if metadata is not None
else {},
json.loads(metadata) if metadata is not None else {},
),
(
{
@@ -358,9 +357,7 @@ class SqliteSaver(BaseCheckpointSaver[str]):
self.serde.loads_typed((type, checkpoint)),
cast(
CheckpointMetadata,
self.jsonplus_serde.loads(metadata)
if metadata is not None
else {},
json.loads(metadata) if metadata is not None else {},
),
(
{
@@ -413,9 +410,9 @@ class SqliteSaver(BaseCheckpointSaver[str]):
thread_id = config["configurable"]["thread_id"]
checkpoint_ns = config["configurable"]["checkpoint_ns"]
type_, serialized_checkpoint = self.serde.dumps_typed(checkpoint)
serialized_metadata = self.jsonplus_serde.dumps(
get_checkpoint_metadata(config, metadata)
)
serialized_metadata = json.dumps(
get_checkpoint_metadata(config, metadata), ensure_ascii=False
).encode("utf-8", "ignore")
with self.cursor() as cur:
cur.execute(
"INSERT OR REPLACE INTO checkpoints (thread_id, checkpoint_ns, checkpoint_id, parent_checkpoint_id, type, checkpoint, metadata) VALUES (?, ?, ?, ?, ?, ?, ?)",
libs/checkpoint-sqlite/langgraph/checkpoint/sqlite/aio.py
+6 -9
View File
@@ -1,6 +1,7 @@
from __future__ import annotations
import asyncio
import json
import random
from collections.abc import AsyncIterator, Callable, Iterator, Sequence
from contextlib import asynccontextmanager
@@ -377,9 +378,7 @@ class AsyncSqliteSaver(BaseCheckpointSaver[str]):
self.serde.loads_typed((type, checkpoint)),
cast(
CheckpointMetadata,
self.jsonplus_serde.loads(metadata)
if metadata is not None
else {},
(json.loads(metadata) if metadata is not None else {}),
),
(
{
@@ -457,9 +456,7 @@ class AsyncSqliteSaver(BaseCheckpointSaver[str]):
self.serde.loads_typed((type, checkpoint)),
cast(
CheckpointMetadata,
self.jsonplus_serde.loads(metadata)
if metadata is not None
else {},
(json.loads(metadata) if metadata is not None else {}),
),
(
{
@@ -503,9 +500,9 @@ class AsyncSqliteSaver(BaseCheckpointSaver[str]):
thread_id = config["configurable"]["thread_id"]
checkpoint_ns = config["configurable"]["checkpoint_ns"]
type_, serialized_checkpoint = self.serde.dumps_typed(checkpoint)
serialized_metadata = self.jsonplus_serde.dumps(
get_checkpoint_metadata(config, metadata)
)
serialized_metadata = json.dumps(
get_checkpoint_metadata(config, metadata), ensure_ascii=False
).encode("utf-8", "ignore")
async with (
self.lock,
self.conn.execute(