Add dangerous parameter to requests tool (#18697)

The tools are already documented as dangerous. Not clear whether adding
an opt-in parameter is necessary or not
This commit is contained in:
Eugene Yurtsev
2024-03-07 15:10:56 -05:00
committed by GitHub
parent dad949eb99
commit e188d4ecb0
5 changed files with 162 additions and 28 deletions

View File

@@ -28,6 +28,23 @@ class BaseRequestsTool(BaseModel):
requests_wrapper: GenericRequestsWrapper
allow_dangerous_requests: bool = False
def __init__(self, **kwargs: Any):
"""Initialize the tool."""
if not kwargs.get("allow_dangerous_requests", False):
raise ValueError(
"You must set allow_dangerous_requests to True to use this tool. "
"Request scan be dangerous and can lead to security vulnerabilities. "
"For example, users can ask a server to make a request to an internal"
"server. It's recommended to use requests through a proxy server "
"and avoid accepting inputs from untrusted sources without proper "
"sandboxing."
"Please see: https://python.langchain.com/docs/security for "
"further security information."
)
super().__init__(**kwargs)
class RequestsGetTool(BaseRequestsTool, BaseTool):
"""Tool for making a GET request to an API endpoint."""