fix: replace eval() with safe type lookup in UserInputField to prevent code injection

[Joshua-Medvinsky]

Problem

UserInputField.from_dict() in agents/tools/base.py calls eval(data["field_type"]) without sanitization. The same pattern exists in agents/models/base.py:1162. Since field_type originates from LLM tool call arguments (which can be influenced by user prompts via prompt injection), this enables arbitrary Python code execution within the agent process.

An attacker who can influence the LLM's tool call output (via prompt injection) can set field_type to __import__('os').system('id') to execute arbitrary commands.

Severity: High (CVSS 8.8) — LLM tool call context → host Python process execution

Fix

Replace eval() with a static allowlist lookup (_SAFE_TYPES dict) that maps type name strings to their Python type objects. Unknown type names default to str. This preserves the intended functionality (converting type name strings to type objects) while eliminating the code injection vector.

Test Plan

• UserInputField.from_dict({"name": "x", "field_type": "int", ...}) → field_type is int
• UserInputField.from_dict({"name": "x", "field_type": "__import__('os').system('id')", ...}) → field_type is str (no code execution)
• UserInputField.from_dict({"name": "x", "field_type": "unknown", ...}) → field_type is str (safe default)

Security Note

This is a high-severity code injection vulnerability exploitable via prompt injection. The fix replaces eval() with a safe allowlist lookup.