Jamesflynn1 / pyRBM

A Python framework to build and simulate stochastic rules-based models.
GNU General Public License v3.0
3 stars 0 forks source link

[FEATURE] Add string sanitization, for saving and loading, propensities, var names and compartment names #41

Open Jamesflynn1 opened 2 months ago

Jamesflynn1 commented 2 months ago

Is your feature request related to a problem? Please describe. Sympy utilises python exec() under the hood, and doesn't santise its input. When loading a model file that has been shared, it is possible malicious code could be inserted into the propensity function. Ideally we should sanitise all input to future proof the code and reduce the security risk. Describe the solution you'd like All non-useful characters are stripped from strings - possibly using regex. Assignment equals is removed (only ==, >=, <=, != would be permitted) function calls will have to be permitted to allow for mathematical functions - the specific function call should be checked perhaps.

Describe alternatives you've considered It is possible to do nothing and leave a warning to the end user to check their model files manually. This would be inefficient for the user and this use case is restricted enough where we can restrict the set of characters provided to the end user of pyRBM.