Repository navigation
Restrict builder YAML code references #5292
Description
Summary
The builder upload endpoint already treats YAML uploads as an RCE-sensitive boundary: it rejects Python files and blocks args keys because YAML config can instantiate or invoke Python code. However, the same upload path still accepts arbitrary dotted code references such as os.system in tool, callback, or sub-agent code fields.
Problem
A YAML-only upload can register an external callable as an agent tool:
agent_class: LlmAgent
name: app
model: gemini-2.5-flash
instruction: call the tool
tools:
- name: os.systemThe YAML agent loader resolves dotted tool names with importlib.import_module() and getattr(). That means the builder upload can expose standard-library callables as tools even though direct Python uploads and args are blocked. If the uploaded agent is run and the tool is selected, the callable executes in the ADK server process.
Expected behavior
Builder-uploaded YAML should not be able to import arbitrary external code. It should allow short ADK built-in tool names and project-local code references for the app being edited, while rejecting external references such as os.system.
Proposed fix
I have a PR prepared that:
- rejects external dotted code references in builder-uploaded YAML for tools, callbacks, schema/model CodeConfig fields, sub-agent
code, and non-built-inagent_classvalues - preserves short built-in tool names such as
google_search - preserves app-local references such as
app.tools.safe_tool.run - handles stdlib app names such as
ossoos.systemcannot be made to look project-local - adds regression tests for unsafe tool, callback, and sub-agent code references
Validation
The patch passes:
python -m pyink --check src/google/adk/cli/fast_api.py tests/unittests/cli/test_fast_api.py
python -m pytest tests/unittests/cli/test_fast_api.py -k "builder_save" -q
python -m pytest tests/unittests/cli/test_fast_api.py -q -k "not builder_get_tmp_true_recreates_tmp and not builder_get_allows_yaml_file_paths and not a2a"
The broader FastAPI slice excludes two existing Windows CRLF response-body assertions and A2A tests, matching the known local Windows baseline unrelated to this change.
Activity
klateefa commentedon Apr 14, 2026
@petrmarinec The problem is that the YAML file can currently load any function using dotted names like
os.system, which can be dangerous. A simple fix is to allow only safe optionsbuilt-in toolnames and project code that starts with something like app.. Everything else should be blocked. This way,no external or unsafe code can run, and the builder stays secureCan you you try and let me know if the issues persists?
petrmarinec commentedon Apr 14, 2026
Hello @klateefa,
I tested that approach locally:
main: builder upload accepts the YAML containingtools: [{name: os.system}]and writes it under the temp app directoryBlocked code reference 'os.system' in 'app/root_agent.yaml'. The 'tools.name' field must reference code under 'app.*'.google_searchapp.tools.safe_tool.runI also re-ran the targeted checks:
PYTHONPATH=src python -m pytest tests/unittests/cli/test_fast_api.py -q -k "builder_save" python -m pyink --check --config pyproject.toml src/google/adk/cli/fast_api.py tests/unittests/cli/test_fast_api.py python -m isort --check-only src/google/adk/cli/fast_api.py tests/unittests/cli/test_fast_api.pyfix: restrict builder YAML code references to the app being edited