Patched patchwork/common/utils/dependency.py

Author: patched.codes[bot]

patchwork/common/utils/dependency.py

@@ -6,9 +6,12 @@
     "notification": ["slack_sdk"],
 }
 
+__SAFE_MODULES = {"semgrep", "depscan", "slack_sdk"}
 
 @lru_cache(maxsize=None)
 def import_with_dependency_group(name):
+    if name not in __SAFE_MODULES:
+        raise ImportError(f"Importing module '{name}' is not allowed.")
     try:
         return importlib.import_module(name)
     except ImportError:
@@ -20,6 +23,5 @@ def import_with_dependency_group(name):
             error_msg = f"Please `pip install patchwork-cli[{dependency_group}]` to use this step"
         raise ImportError(error_msg)
 
-
 def slack_sdk():
     return import_with_dependency_group("slack_sdk")