CVE-2024-45858

@@ -1,6 +1,7 @@
 # ruff: noqa
 """This module contains the constants and utils used by the validator.py."""
 
+from ast import literal_eval
 from typing import Any, Dict, List, Optional, Tuple, Type, Union, cast
 
 from guardrails_api_client import ValidatorReference
@@ -33,7 +34,7 @@ def parse_rail_arguments(arg_tokens: List[str]) -> List[Any]:
                 #   and be responsible for parsing them to the correct types.
                 # Option 2: We use something like the Validator Manifest that describes the arguments
                 #   to parse the values from the string WITHOUT an eval.
-                t = eval(t)
+                t = literal_eval(t)
             except (ValueError, SyntaxError, NameError) as e:
                 raise ValueError(
                     f"Python expression `{t}` is not valid, "

@@ -22,7 +22,7 @@ def __init__(self, *args, **kwargs):
         ("test-validator: a", ["a"]),
         ("test-validator: a b", ["a", "b"]),
         (
-            "test-validator: {list(range(5))} a b",
+            "test-validator: {[0,1,2,3,4]} a b",
             [[0, 1, 2, 3, 4], "a", "b"],
         ),
         ("test-validator: {[1, 2, 3]} a b", [[1, 2, 3], "a", "b"]),
@@ -31,7 +31,7 @@ def __init__(self, *args, **kwargs):
             [{"a": 1, "b": 2}, "c", "d"],
         ),
         (
-            "test-validator: {1 + 2} {{'a': 1, 'b': 2}} c d",
+            "test-validator: {3} {{'a': 1, 'b': 2}} c d",
             [3, {"a": 1, "b": 2}, "c", "d"],
         ),
     ],