PatchWork AutoFix

[patched-admin]

This pull request from patched fixes 6 issues.

---

• File changed: patchwork/common/tools/csvkit_tool.py
  Use parameterized queries to prevent SQL injection

  The code has been modified to use parameterized queries in place of formatted strings for executing SQL statements. This change mitigates the risk of SQL injection by using safer query execution methods provided by sqlite3.

• File changed: patchwork/common/utils/step_typing.py
  Implement whitelist for dynamic module imports for validate_step_with_inputs function.

  Implemented a whitelist mechanism to restrict dynamic module imports in the validate_step_with_inputs function to only trusted modules. This prevents loading of arbitrary code by restricting the importlib.import_module call to predefined module paths.

• File changed: patchwork/app.py
  Fix untrusted input vulnerability in importlib.import_module

  Implemented a whitelist for allowable module paths to ensure importlib.import_module() only loads trusted modules, mitigating the risk of arbitrary code execution.

• File changed: patchwork/common/tools/bash_tool.py
  Fix security vulnerability by removing shell=True in subprocess.run

  Removed the shell=True argument in the subprocess.run call and modified it to pass the command as a list, which prevents shell injection vulnerabilities.

• File changed: patchwork/common/utils/dependency.py
  Implement whitelist for import statements to prevent execution of arbitrary modules

  Introduced a whitelist mechanism to the import_with_dependency_group function, ensuring that only modules listed in the __DEPENDENCY_GROUPS dictionary can be dynamically imported, preventing execution of arbitrary and potentially harmful modules.

• File changed: patchwork/steps/CallShell/CallShell.py
  Remove usage of 'shell=True' in subprocess.run to prevent shell injection vulnerability

  Replaced shell=True with shell=False in subprocess.run, and utilized shlex.split to properly construct the command list, preventing potential shell injection vulnerabilities.