Patched patchwork/common/utils/dependency.py

Author: patched.codes[bot]

patchwork/common/utils/dependency.py

@@ -6,9 +6,13 @@
     "notification": ["slack_sdk"],
 }
 
+__ALLOWED_MODULES = {module for modules in __DEPENDENCY_GROUPS.values() for module in modules}
 
 @lru_cache(maxsize=None)
 def import_with_dependency_group(name):
+    if name not in __ALLOWED_MODULES:
+        raise ImportError(f"Import of untrusted module '{name}' is not allowed.")
+
     try:
         return importlib.import_module(name)
     except ImportError:
@@ -20,6 +24,5 @@ def import_with_dependency_group(name):
             error_msg = f"Please `pip install patchwork-cli[{dependency_group}]` to use this step"
         raise ImportError(error_msg)
 
-
 def slack_sdk():
     return import_with_dependency_group("slack_sdk")