mirror of https://github.com/microsoft/agent-framework.git synced 2026-06-16 21:04:09 +08:00

Files

T

Ahmed Muhsin 09b3e2e4f0 Python: Prevent pickle deserialization of untrusted HITL HTTP input (#4566 )

* fix: prevent pickle deserialization of untrusted HITL input

Add strip_pickle_markers() to sanitize HTTP input before it reaches
pickle.loads() via the checkpoint decoding path. Applied as a 3-layer
defence-in-depth:

1. _app.py: sanitize req.get_json() at the HTTP boundary
2. _workflow.py: sanitize in _deserialize_hitl_response() before decode
3. _serialization.py: sanitize in reconstruct_to_type() as final guard

Any dict containing __pickled__ or __type__ markers from untrusted
sources is replaced with None, blocking arbitrary code execution via
crafted payloads to POST /workflow/respond/{instanceId}/{requestId}.

Includes 12 new unit tests covering the sanitizer and end-to-end
attack prevention.

* refactor: address review concerns for pickle fix

1. Remove deserialize_value() fallback in _deserialize_hitl_response
   untrusted HITL data now returns as-is when no type hint is available,
   never flowing into pickle.loads().

2. Move strip_pickle_markers() out of reconstruct_to_type()  the function
   is general-purpose again; untrusted-data callers are responsible for
   sanitizing first (documented with NOTE comment).

3. Define _PICKLE_MARKER/_TYPE_MARKER as local constants with import-time
   assertions against core's values  decouples from private names while
   failing loudly if core ever changes them.

4. Update tests to reflect new responsibility boundaries.

* fix: simplify warning message and fix ruff RUF001 lint

* fix: suppress pyright reportPrivateUsage on core marker imports

* Lower marker-strip log from warning to debug to avoid log flooding

* Replace assert with RuntimeError for marker sync checks (ruff S101)

* Fix pyright and ruff CI errors in security fix

- Use cast() for dict/list comprehensions in strip_pickle_markers (pyright)
- type: ignore for narrowed dict return in _workflow.py (pyright)
- Simplify marker imports: use core constants directly, remove local copies
- Remove duplicate pyright ignore comment

* Remove duplicate end-to-end test in TestStripPickleMarkers

* Suppress mypy redundant-cast on list cast needed by pyright

09b3e2e4f0 · 2026-03-10 19:29:33 +00:00

History

agent_framework_azurefunctions

Python: Prevent pickle deserialization of untrusted HITL HTTP input (#4566 )

2026-03-10 19:29:33 +00:00

tests

Python: Prevent pickle deserialization of untrusted HITL HTTP input (#4566 )

2026-03-10 19:29:33 +00:00

AGENTS.md

.NET: Python: Add AGENTS.md files and update coding standards (#3644 )

2026-02-05 10:27:46 +00:00

LICENSE

.NET: Python: Azure Functions feature branch (#1916 )

2025-11-13 02:00:53 +00:00

pyproject.toml

Python: Fix Python pyright package scoping and typing remediation (#4426 )

2026-03-05 15:32:24 +00:00

README.md

.NET: Python: Azure Functions feature branch (#1916 )

2025-11-13 02:00:53 +00:00

README.md

Get Started with Microsoft Agent Framework Durable Functions

Please install this package via pip:

pip install agent-framework-azurefunctions --pre

Durable Agent Extension

The durable agent extension lets you host Microsoft Agent Framework agents on Azure Durable Functions so they can persist state, replay conversation history, and recover from failures automatically.

Basic Usage Example

See the durable functions integration sample in the repository to learn how to:

from agent_framework.azure import AgentFunctionApp

_app = AgentFunctionApp()

Register agents with AgentFunctionApp
Post messages using the generated /api/agents/{agent_name}/run endpoint

For more details, review the Python README and the samples directory.