Sebastion d619d86c4c fix: replace dangerous expression evaluation with AST-validated safe math parser (CWE-95) ... Replace unconstrained expression evaluation in calculate_math tool handlers with safe_eval_math(), which parses into an AST and only allows literal numbers and basic arithmetic operators. Function calls, attribute access, and name lookups are rejected, preventing arbitrary code execution via prompt injection through LLM-generated tool calls. Affected files: - scripts/web_demo.py (Streamlit demo) - scripts/eval_toolcall.py (tool call testing) - trainer/train_agent.py (agent training)		2026-04-23 19:36:39 +01:00
..
chat_api.py	[update] minimind-3	2026-03-25 23:57:45 +08:00
convert_model.py	[update] tie embedding	2026-04-19 21:57:28 +08:00
eval_toolcall.py	fix: replace dangerous expression evaluation with AST-validated safe math parser (CWE-95)	2026-04-23 19:36:39 +01:00
serve_openai_api.py	[update] fp16 inference	2026-03-27 16:29:46 +08:00
web_demo.py	fix: replace dangerous expression evaluation with AST-validated safe math parser (CWE-95)	2026-04-23 19:36:39 +01:00