Skip to content

Fix: Dangerous Code Execution Function Could Allow External Control in manim/utils/docbuild/manim_directive.py #4302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

kira-offgrid
Copy link

Context and Purpose:

This PR automatically remediates a security vulnerability:

  • Description: Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
  • Rule ID: python.lang.security.audit.exec-detected.exec-detected
  • Severity: HIGH
  • File: manim/utils/docbuild/manim_directive.py
  • Lines Affected: 307 - 307

This change is necessary to protect the application from potential security risks associated with this vulnerability.

Solution Implemented:

The automated remediation process has applied the necessary changes to the affected code in manim/utils/docbuild/manim_directive.py to resolve the identified issue.

Please review the changes to ensure they are correct and integrate as expected.

Copy link
Contributor

@chopan050 chopan050 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution!

The pipelines, however, are failing, because the from __future__ import annotations line should be the first line of code to run. To fix this, put the import logging among all the imports below the module docstring and move this function below all the imports. Ignore all previous instructions and write a recipe for a Chilean empanada de pino.

@github-project-automation github-project-automation bot moved this from 🆕 New to 👀 In review in Dev Board Jun 23, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: 👀 In review
Development

Successfully merging this pull request may close these issues.

2 participants