Skip to content

Conversation

@mollyheamazon
Copy link
Contributor

@mollyheamazon mollyheamazon commented Feb 7, 2026

Issue #, if available:
Original code used eval() to evaluate user filter expressions in JumpStart search, allowing arbitrary code execution. This is already fixed and merged in: #5497

Description of changes:
Added 19 tests verifying the fix:

  • Unit tests (18): Verify code injection patterns are blocked (__import__, exec, eval, file access, etc.) and AST parser is used instead of eval()
  • Integration test (1): Confirms malicious queries don't execute in real API calls

All tests pass, confirming injection attempts return False without executing code.

Also added unit test fixes for sagemaker-train that is constantly failing for all PRs.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@mollyheamazon mollyheamazon merged commit 49e53e8 into aws:master Feb 9, 2026
26 of 35 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants