CVE-2024-45850

@@ -1,3 +1,4 @@
+import ast
 import sys
 from typing import List, Optional
 
@@ -329,7 +330,7 @@ def insert(self, table_name: str, data: pd.DataFrame):
         # ensure metadata is a dict, convert to dict if it is a string
         if data.get(TableField.METADATA.value) is not None:
             data[TableField.METADATA.value] = data[TableField.METADATA.value].apply(
-                lambda x: x if isinstance(x, dict) else eval(x)
+                lambda x: x if isinstance(x, dict) else ast.literal_eval(x)
             )
 
         # convert to dict

@@ -1,3 +1,4 @@
+import ast
 from datetime import datetime, timezone
 from typing import Text, List, Dict, Any
 
@@ -249,10 +250,10 @@ def create_a_list(
         url = f"https://graph.microsoft.com/v1.0/sites/{site_id}/lists/"
         payload = {}
         if column:
-            column = eval(column)
+            column = ast.literal_eval(column)
             payload["column"] = column
         payload["displayName"] = display_name
-        payload["list"] = eval(list_template)
+        payload["list"] = ast.literal_eval(list_template)
         create_an_entity(url=url, payload=payload, bearer_token=self.bearer_token)
 
     def get_site_columns_by_site(
@@ -410,7 +411,7 @@ def create_a_site_column(
         url = f"https://graph.microsoft.com/v1.0/sites/{site_id}/columns/"
         payload = {}
         if text:
-            text = eval(text)
+            text = ast.literal_eval(text)
             payload["text"] = text
         payload["name"] = name
         if enforce_unique_values is not None:
@@ -574,5 +575,5 @@ def create_an_item(self, site_id: str, list_id: str, fields: str) -> None:
         url = f"https://graph.microsoft.com/v1.0/sites/{site_id}/lists/{list_id}/items/"
         payload = {}
         if fields:
-            payload["fields"] = eval(fields)
+            payload["fields"] = ast.literal_eval(fields)
         create_an_entity(url=url, payload=payload, bearer_token=self.bearer_token)

@@ -1,3 +1,4 @@
+import ast
 from datetime import datetime
 from typing import List, Optional
 
@@ -335,7 +336,7 @@ def select(
             # assuming there would be only one vector based search per query
             vector_filter = vector_filter[0]
             near_vector = {
-                "vector": eval(vector_filter.value)
+                "vector": ast.literal_eval(vector_filter.value)
                 if isinstance(vector_filter.value, str)
                 else vector_filter.value
             }

@@ -242,7 +242,7 @@ def _dispatch_update(self, query: Update):
             if k == TableField.EMBEDDINGS.value and isinstance(v, str):
                 # it could be embeddings in string
                 try:
-                    v = eval(v)
+                    v = ast.literal_eval(v)
                 except Exception:
                     pass
             row[k] = v