arya2004 / arya2004/Data-Filtering-Chatbot
Avoid using exec() for untrusted code execution
Open
enhancement
good first issue
hacktoberfest
hacktoberfest-accepted
python
refactor
- Dominant language
- Python
- Stars
- 2
- Forks
- 6
- PR merge metrics
- No merged PRs in 30d
Description
### 🔐 Security Issue: Avoid `exec()` for LLM-generated code
Currently, the system uses `exec()` to execute Python code returned by the LLM. This poses **severe security risks**.
#### 💡 Proposed Fix:
- Avoid `exec()`.
- Have the LLM return structured data (e.g., JSON filters) instead.
- Use Python’s native operators to apply the filter safely.
> Example: Instead of `df['Sales'] > 1000`, have the LLM return:
```json
{ "column": "Sales", "operator": ">", "value": 1000 }
````
Contributor guide
Assessment
This issue has not been assessed yet.