Go to file
Jamal a2f191a322
Replace JIRA Arbitrary Code Execution vulnerability with finer grain API wrapper (#6992)
This fixes #4833 and the critical vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2023-34540

Previously, the JIRA API Wrapper had a mode that simply pipelined user
input into an `exec()` function.
[The intended use of the 'other' mode is to cover any of Atlassian's API
that don't have an existing
interface](cc33bde74f/langchain/tools/jira/prompt.py (L24))

Fortunately all of the [Atlassian JIRA API methods are subfunctions of
their `Jira`
class](https://atlassian-python-api.readthedocs.io/jira.html), so this
implementation calls these subfunctions directly.

As well as passing a string representation of the function to call, the
implementation flexibly allows for optionally passing args and/or
keyword-args. These are given as part of the dictionary input. Example:
```
    {
        "function": "update_issue_field",   #function to execute
        "args": [                           #list of ordered args similar to other examples in this JiraAPIWrapper
            "key",
            {"summary": "New summary"}
        ],
        "kwargs": {}                        #dict of key value keyword-args pairs
    }
```

the above is equivalent to `self.jira.update_issue_field("key",
{"summary": "New summary"})`

Alternate query schema designs are welcome to make querying easier
without passing and evaluating arbitrary python code. I considered
parsing (without evaluating) input python code and extracting the
function, args, and kwargs from there and then pipelining them into the
callable function via `*f(args, **kwargs)` - but this seemed more
direct.

@vowelparrot @dev2049

---------

Co-authored-by: Jamal Rahman <jamal.rahman@builder.ai>
2023-07-05 15:56:01 -04:00
.devcontainer Update dev container (#6189) 2023-06-16 15:42:14 -07:00
.github update pr tmpl (#7095) 2023-07-03 13:34:03 -06:00
docs Create arize_llm_observability.ipynb (#7000) 2023-07-05 15:55:47 -04:00
langchain Replace JIRA Arbitrary Code Execution vulnerability with finer grain API wrapper (#6992) 2023-07-05 15:56:01 -04:00
tests Replace JIRA Arbitrary Code Execution vulnerability with finer grain API wrapper (#6992) 2023-07-05 15:56:01 -04:00
.dockerignore fix: tests with Dockerfile (#2382) 2023-04-04 06:47:19 -07:00
.flake8 change run to use args and kwargs (#367) 2022-12-18 15:54:56 -05:00
.gitattributes Update dev container (#6189) 2023-06-16 15:42:14 -07:00
.gitignore Doc refactor (#6300) 2023-06-16 11:52:56 -07:00
.gitmodules Doc refactor (#6300) 2023-06-16 11:52:56 -07:00
.readthedocs.yaml Page per class-style api reference (#6560) 2023-06-30 09:23:32 -07:00
CITATION.cff bump version to 0069 (#710) 2023-01-24 00:24:54 -08:00
dev.Dockerfile Update dev container (#6189) 2023-06-16 15:42:14 -07:00
Dockerfile make ARG POETRY_HOME available in multistage (#3882) 2023-05-01 20:57:41 -07:00
LICENSE add license (#50) 2022-11-01 21:12:02 -07:00
Makefile Doc refactor (#6300) 2023-06-16 11:52:56 -07:00
poetry.lock Support for SPARQL (#7165) 2023-07-05 13:00:16 -04:00
poetry.toml fix Poetry 1.4.0+ installation (#1935) 2023-03-27 08:27:54 -07:00
pyproject.toml Support for SPARQL (#7165) 2023-07-05 13:00:16 -04:00
README.md Del linkcheck readme (#6317) 2023-06-16 16:18:45 -07:00

🦜🔗 LangChain

Building applications with LLMs through composability

Release Notes lint test Downloads License: MIT Twitter Open in Dev Containers Open in GitHub Codespaces GitHub star chart Dependency Status Open Issues

Looking for the JS/TS version? Check out LangChain.js.

Production Support: As you move your LangChains into production, we'd love to offer more comprehensive support. Please fill out this form and we'll set up a dedicated support Slack channel.

Quick Install

pip install langchain or conda install langchain -c conda-forge

🤔 What is this?

Large language models (LLMs) are emerging as a transformative technology, enabling developers to build applications that they previously could not. However, using these LLMs in isolation is often insufficient for creating a truly powerful app - the real power comes when you can combine them with other sources of computation or knowledge.

This library aims to assist in the development of those types of applications. Common examples of these applications include:

Question Answering over specific documents

💬 Chatbots

🤖 Agents

📖 Documentation

Please see here for full documentation on:

  • Getting started (installation, setting up the environment, simple examples)
  • How-To examples (demos, integrations, helper functions)
  • Reference (full API docs)
  • Resources (high-level explanation of core concepts)

🚀 What can this help with?

There are six main areas that LangChain is designed to help with. These are, in increasing order of complexity:

📃 LLMs and Prompts:

This includes prompt management, prompt optimization, a generic interface for all LLMs, and common utilities for working with LLMs.

🔗 Chains:

Chains go beyond a single LLM call and involve sequences of calls (whether to an LLM or a different utility). LangChain provides a standard interface for chains, lots of integrations with other tools, and end-to-end chains for common applications.

📚 Data Augmented Generation:

Data Augmented Generation involves specific types of chains that first interact with an external data source to fetch data for use in the generation step. Examples include summarization of long pieces of text and question/answering over specific data sources.

🤖 Agents:

Agents involve an LLM making decisions about which Actions to take, taking that Action, seeing an Observation, and repeating that until done. LangChain provides a standard interface for agents, a selection of agents to choose from, and examples of end-to-end agents.

🧠 Memory:

Memory refers to persisting state between calls of a chain/agent. LangChain provides a standard interface for memory, a collection of memory implementations, and examples of chains/agents that use memory.

🧐 Evaluation:

[BETA] Generative models are notoriously hard to evaluate with traditional metrics. One new way of evaluating them is using language models themselves to do the evaluation. LangChain provides some prompts/chains for assisting in this.

For more information on these concepts, please see our full documentation.

💁 Contributing

As an open-source project in a rapidly developing field, we are extremely open to contributions, whether it be in the form of a new feature, improved infrastructure, or better documentation.

For detailed information on how to contribute, see here.