arya2004 / arya2004/Data-Filtering-Chatbot

Avoid using exec() for untrusted code execution

Open
#1 1 comment 0 reactions 1 assignee Claimed by @Suthar345Piyush View on GitHub
enhancement good first issue hacktoberfest hacktoberfest-accepted python refactor
Dominant language
Python
Stars
2
Forks
6
PR merge metrics
No merged PRs in 30d

Description

### 🔐 Security Issue: Avoid `exec()` for LLM-generated code

Currently, the system uses `exec()` to execute Python code returned by the LLM. This poses **severe security risks**.

#### 💡 Proposed Fix:
- Avoid `exec()`.
- Have the LLM return structured data (e.g., JSON filters) instead.
- Use Python’s native operators to apply the filter safely.

> Example: Instead of `df['Sales'] > 1000`, have the LLM return:
```json
{ "column": "Sales", "operator": ">", "value": 1000 }
````

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.