Refractor/SecureZodSchemaParser (#4898)

* refactor: Implement SecureZodSchemaParser for safe Zod schema handling and add FilterParser for Supabase filters

* Replaced direct Zod schema evaluation with SecureZodSchemaParser in StructuredOutputParserAdvanced and CustomTool.
* Introduced FilterParser to safely handle Supabase filter strings, preventing arbitrary code execution.
* Added new filterParser.ts file to encapsulate filter parsing logic.
* Updated Supabase vector store to utilize the new FilterParser for RPC filters.
* Created secureZodParser.ts for secure parsing of Zod schemas.

* remove console log
This commit is contained in:
Henry Heng
2025-07-19 01:11:31 +01:00
committed by GitHub
parent fbe9f34a60
commit 96a57a58e7
5 changed files with 536 additions and 12 deletions
@@ -3,6 +3,7 @@ import { convertSchemaToZod, getBaseClasses, getVars } from '../../../src/utils'
import { DynamicStructuredTool } from './core'
import { z } from 'zod'
import { DataSource } from 'typeorm'
import { SecureZodSchemaParser } from '../../../src/secureZodParser'
class CustomTool_Tools implements INode {
label: string
@@ -119,8 +120,7 @@ class CustomTool_Tools implements INode {
if (customToolName) obj.name = customToolName
if (customToolDesc) obj.description = customToolDesc
if (customToolSchema) {
const zodSchemaFunction = new Function('z', `return ${customToolSchema}`)
obj.schema = zodSchemaFunction(z)
obj.schema = SecureZodSchemaParser.parseZodSchema(customToolSchema) as z.ZodObject<ICommonObject, 'strip', z.ZodTypeAny>
}
const variables = await getVars(appDataSource, databaseEntities, nodeData, options)