_is_malicious_code doesn't look for whole word

[shoebham]

System Info

Pandas AI version: 2.2.14 Python Version: 3.10.0

🐛 Describe the bug

I was trying to run a query where I had mentioned OSE, and I got the error

"Code shouldn't use 'os', 'io' or 'chr', 'b64decode' functions as this could lead to malicious code execution."

So I went to code_cleaning.py and saw this line of code

return any(module in code for module in dangerous_modules)

This was looking for just presence of the words instead of the whole word, So it returned true for OSE and it contains os

[dosubot[bot]]

Hello @shoebham! I'm here to help you with bugs, questions, and becoming a contributor. Let's squash those bugs together! 🤖

The _is_malicious_code function in code_cleaning.py uses simple substring matching to identify potentially dangerous modules and functions, which can lead to false positives like flagging "OSE" as containing "os". The function checks for the presence of specific substrings within the code, rather than ensuring that these substrings are whole words or standalone identifiers ^[1].

To continue talking to Dosu, mention @dosu.

[nrajput05]

I am having the same issue. I get this error quite often and if I run multiple times, eventually I get the right answer. Here is my query: How many Issues are assigned to assignee named xyz

I am querying a CSV of a JIRA sprint.

`/Users/johnpc/Python/LlamaRAG/projectenv/lib/python3.12/site-packages/pandasai/pipelines/chat/code_cleaning.py", line 125, in get_code_to_run raise MaliciousQueryError( pandasai.exceptions.MaliciousQueryError: Code shouldn't use 'os', 'io' or 'chr', 'b64decode' functions as this could lead to malicious code execution. Unfortunately, I was not able to answer your question, because of the following error:

Code shouldn't use 'os', 'io' or 'chr', 'b64decode' functions as this could lead to malicious code execution.`

[shoebham]

are you using the latest version? someone merged it a few days ago. So it should be fixed now.

[nrajput05]

My specs are:

pandas 1.5.3 pandasai 2.3.0

[ethan-pxw]

Similar issue for me too when querying a CSV: pandasai.exceptions.MaliciousQueryError: Restricted library import detected: io. Using pandasai==2.4.1.