fix: replace eval() with safe type lookup in UserInputField to prevent code injection

src/ii_agent/agents/models/base.py

@@ -1158,8 +1158,13 @@ async def arun_function_calls(
                 for input_field in fc.arguments.get("user_input_fields", []):
                     field_type = input_field.get("field_type")
                     try:
+                        _SAFE_TYPES = {
+                            "str": str, "int": int, "float": float, "bool": bool,
+                            "list": list, "dict": dict, "tuple": tuple, "set": set,
+                            "bytes": bytes, "NoneType": type(None),
+                        }
                         python_type = (
-                            eval(field_type) if isinstance(field_type, str) else field_type
+                            _SAFE_TYPES.get(field_type, str) if isinstance(field_type, str) else field_type
                         )
                     except (NameError, SyntaxError):
                         python_type = str  # Default to str if type is invalid

src/ii_agent/agents/tools/base.py

@@ -29,9 +29,17 @@ def to_dict(self) -> Dict[str, Any]:
 
     @classmethod
     def from_dict(cls, data: Dict[str, Any]) -> "UserInputField":
+        # Use a safe type lookup instead of eval() to prevent code injection
+        _SAFE_TYPES = {
+            "str": str, "int": int, "float": float, "bool": bool,
+            "list": list, "dict": dict, "tuple": tuple, "set": set,
+            "bytes": bytes, "NoneType": type(None),
+        }
+        field_type_name = data["field_type"]
+        field_type = _SAFE_TYPES.get(field_type_name, str)
         return cls(
             name=data["name"],
-            field_type=eval(data["field_type"]),  # Convert string type name to actual type
+            field_type=field_type,
             description=data["description"],
             value=data["value"],
         )