From f2faf92771c775b15dc180e6edf0659de9934152 Mon Sep 17 00:00:00 2001 From: anupamme Date: Sat, 3 Oct 2026 05:04:36 +0000 Subject: [PATCH] harden: secure dynamic_imports.py Untrusted user input in `importlib Resolves python.lang.security.audit.non-literal-import.non-literal-import --- src/openrouter/utils/dynamic_imports.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/openrouter/utils/dynamic_imports.py b/src/openrouter/utils/dynamic_imports.py index 673edf82..296ffa41 100644 --- a/src/openrouter/utils/dynamic_imports.py +++ b/src/openrouter/utils/dynamic_imports.py @@ -2,11 +2,16 @@ from importlib import import_module import builtins +import re import sys +_RELATIVE_MODNAME_RE = re.compile(r"^\.[A-Za-z_][A-Za-z0-9_]*$") + def dynamic_import(package, modname, retries=3): """Import a module relative to package, retrying on KeyError from half-initialized modules.""" + if not isinstance(modname, str) or not _RELATIVE_MODNAME_RE.match(modname): + raise ValueError(f"Refusing to import untrusted module name: {modname!r}") for attempt in range(retries): try: return import_module(modname, package)