🔒 fix remote code execution vulnerability in qiskit compiler#90
🔒 fix remote code execution vulnerability in qiskit compiler#90refraction-ray wants to merge 1 commit into
Conversation
…iskit compiler The _free_pi function used eval() to process parameter strings from QASM, creating a remote code execution vulnerability. This change introduces a restricted _safe_eval function that only allows basic arithmetic and tuples, significantly improving the security posture of the compiler. Co-authored-by: refraction-ray <35157286+refraction-ray@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
1 participant
🎯 What: Replaced unsafe
eval()with a restricted AST-based evaluator_safe_evalin the_free_pifunction withintensorcircuit/compiler/qiskit_compiler.py.eval()on parameter strings extracted from QASM allowed for arbitrary Python code execution. If an attacker could provide a malicious QASM string to the compiler, they could execute arbitrary commands on the system running the code.🛡️ Solution: Implemented
_safe_eval, which parses the input string into an Abstract Syntax Tree (AST) and only permits a strict allowlist of nodes: constants (numbers), binary operations (addition, subtraction, multiplication, division, power), unary operations (plus, minus), and tuples. Any other node type, such as function calls or imports, triggers aValueError. This ensures that mathematical expressions commonly found in QASM (wherepiis pre-replaced with its numerical value) can still be evaluated securely.PR created automatically by Jules for task 15022396937964748523 started by @refraction-ray