Builder upload YAML validation can be bypassed

The YAML validation in the builder upload endpoint does not fully restrict values that could resolve to arbitrary Python references at agent load time.

PR #5344 hardens the validation to reject these values.

@TristanInSec

Hi @TristanInSec , To help us better understand the issue, could you please provide the steps to reproduce it? Also, a minimal reproducible code would also be very helpful.
Thanks.

The reproduction steps are in the companion PR #5344. In short:

Start the dev server in web mode: adk web agents/
Upload a YAML file with a dotted tool name via /builder/save:
```
name: my_agent
tools:
  - name: os.system
```
The YAML is accepted and written to disk. When the agent is loaded, os.system resolves through importlib.import_module() and becomes a callable tool the LLM can invoke with arbitrary arguments.

The PR adds validation that rejects dotted (fully qualified) Python references in name, agent_class, and code fields, while still allowing simple built-in names like google_search.

@TristanInSec

Hi @TristanInSec , Thanks for the clarification.

Your PR is currently under review. Our team is going over the new validation logic to ensure it covers all the necessary fields, and it will be merged once the review is complete and everything looks good.

Thanks for your contribution.

Closing with the issue. Thanks!

Navigation Menu

Repository navigation

Builder upload YAML validation can be bypassed #5347

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Builder upload YAML validation can be bypassed #5347

Description

Activity

sanketpatil06 commented on Apr 16, 2026

TristanInSec commented on Apr 16, 2026

sanketpatil06 commented on Apr 17, 2026

sasha-gitg commented on Apr 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions