github/langchain
1
0
Fork 0
mirror of https://github.com/hwchase17/langchain.git synced 2026-06-09 10:17:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(core): harden check for txt files in deprecated prompt loading functions (#36471)

Browse Source
This commit is contained in:
ccurme
2026-04-02 16:42:48 -04:00
committed by GitHub
parent c9f51aef85
commit 0b5f2c08ee
2 changed files with 52 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libs/core/langchain_core/prompts/loading.py
View File

@@ -96,9 +96,12 @@ def _load_template(
template_path = Path(config.pop(f"{var_name}_path"))
if not allow_dangerous_paths:
_validate_path(template_path)
# Resolve symlinks before checking the suffix so that a symlink named
# "exploit.txt" pointing to a non-.txt file is caught.
resolved_path = template_path.resolve()
# Load the template.
if template_path.suffix == ".txt":
template = template_path.read_text(encoding="utf-8")
if resolved_path.suffix == ".txt":
template = resolved_path.read_text(encoding="utf-8")
else:
raise ValueError
# Set the template variable to the extracted variable.