From 133ec1b816334d65e2216f38e7dd2d033ff486a4 Mon Sep 17 00:00:00 2001
From: TPTBusiness <tpt.requests@pm.me>
Date: Thu, 30 Apr 2026 09:34:47 +0200
Subject: [PATCH] fix(security): replace eval() with ast.literal_eval and add
 request timeouts (B307, B113)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- submit.py: eval(json_str) → ast.literal_eval(json_str) for safe
  Python-literal parsing without arbitrary code execution
- info.py: add timeout=30 to both requests.get() calls to prevent
  indefinite hangs on unresponsive GitHub API

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 rdagent/app/utils/info.py                                    | 4 ++--
 .../scenarios/data_science/proposal/exp_gen/select/submit.py | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/rdagent/app/utils/info.py b/rdagent/app/utils/info.py
index 7e79f691..e0c03596 100644
--- a/rdagent/app/utils/info.py
+++ b/rdagent/app/utils/info.py
@@ -54,11 +54,11 @@ def rdagent_info():
     current_version = importlib.metadata.version("rdagent")
     logger.info(f"RD-Agent version: {current_version}")
     api_url = f"https://api.github.com/repos/microsoft/RD-Agent/contents/requirements.txt?ref=main"
-    response = requests.get(api_url)
+    response = requests.get(api_url, timeout=30)
     if response.status_code == 200:
         files = response.json()
         file_url = files["download_url"]
-        file_response = requests.get(file_url)
+        file_response = requests.get(file_url, timeout=30)
         if file_response.status_code == 200:
             all_file_contents = file_response.text.split("\n")
         else:
diff --git a/rdagent/scenarios/data_science/proposal/exp_gen/select/submit.py b/rdagent/scenarios/data_science/proposal/exp_gen/select/submit.py
index fb3fa088..ea6b9533 100644
--- a/rdagent/scenarios/data_science/proposal/exp_gen/select/submit.py
+++ b/rdagent/scenarios/data_science/proposal/exp_gen/select/submit.py
@@ -1,3 +1,4 @@
+import ast
 import json
 import os
 import pickle
@@ -587,8 +588,8 @@ def _parsing_score(grade_stdout: str) -> Optional[float]:
         except:
             pass
         try:
-            # Priority 2: Eval dict
-            return float(eval(json_str)["score"])
+            # Priority 2: safe literal eval for Python-style dicts
+            return float(ast.literal_eval(json_str)["score"])
         except:
             pass
         try: