Skip to content
Open
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion python/semantic_kernel/contents/utils/data_uri.py
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,16 @@ def from_data_uri(cls: type[_T], data_uri: str | Url, default_mime_type: str = "
if not data or "," not in data:
raise ContentInitializationError("Invalid data uri format. The data is missing.")

pattern = "(((?P<mime_type>[a-zA-Z]+/[a-zA-Z-]+)(?P<parameters>(;[a-zA-Z0-9]+=+[a-zA-Z0-9]+)*))?(;+(?P<data_format>.*)))?(,(?P<data_str>.*))" # noqa: E501
# Parameters use the RFC 2045 token alphabet, which is broader than a
# media type's restricted-name alphabet. RFC 2397 allows parameters even
# when the default text/plain media type is omitted.
parameter_token = r"[a-zA-Z0-9!#$%&'*+.^_`|~-]+"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The current pre-commit job fails on this assignment with Bandit B105:hardcoded_password_string (https://github.com/microsoft/semantic-kernel/actions/runs/40984502209). This is a false positive: the value is a regex, not a credential, but the variable name parameter_token triggers the check. Please rename it to something like parameter_pattern so the existing hook passes without weakening the security checks.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done — renamed the local regex variable to parameter_pattern (both the definition and the two references in the f-string). Bandit B105 no longer fires; I left the token alphabet and behavior unchanged and did not add # nosec. Verified locally with the same pre-commit hook (bandit passes) and pytest tests/unit/contents/test_data_uri.py (48 passed).

pattern = (
r"(?P<mime_type>[a-zA-Z0-9!#$&^_.+-]+/[a-zA-Z0-9!#$&^_.+-]+)?"
rf"(?P<parameters>(;{parameter_token}={parameter_token})*)"
r"(;+(?P<data_format>[a-zA-Z0-9!#$&^_.+-]*))?"
r"(,(?P<data_str>.*))"
)
match = re.match(pattern, data)
if not match:
raise ContentInitializationError("Invalid data uri format.")
Expand Down
44 changes: 44 additions & 0 deletions python/tests/unit/contents/test_data_uri.py
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,33 @@
"base64",
id="with_params",
),
pytest.param(
"data:image/svg+xml;base64,PHN2Zy8+",
b"<svg/>",
"PHN2Zy8+",
"image/svg+xml",
{},
"base64",
id="mime_type_with_plus",
),
pytest.param(
"data:text/plain;charset=utf-8;base64,SGVsbG8=",
b"Hello",
"SGVsbG8=",
"text/plain",
{"charset": "utf-8"},
"base64",
id="parameter_before_data_format",
),
pytest.param(
"data:application/vnd.ms-excel;base64,AAAA",
b"\x00\x00\x00",
"AAAA",
"application/vnd.ms-excel",
{},
"base64",
id="vendor_mime_type",
),
],
)
def test_data_uri_from_data_uri_str(
Expand Down Expand Up @@ -310,3 +337,20 @@ def test_array():
def test__data_str(data_bytes, data_str, data_array, data_format, expected_output):
data_uri = DataUri(data_bytes=data_bytes, data_str=data_str, data_array=data_array, data_format=data_format)
assert data_uri._data_str() == expected_output


@pytest.mark.parametrize("media_type", ["text/plain", ""])
@pytest.mark.parametrize("encoding,payload", [("", "Hello"), (";base64", "SGVsbG8=")])
def test_data_uri_parameter_without_required_media_type(media_type, encoding, payload):
result = DataUri.from_data_uri(f"data:{media_type};charset=utf-8{encoding},{payload}")
assert result.data_bytes == b"Hello"
assert result.mime_type == "text/plain"
assert result.parameters == {"charset": "utf-8"}
assert result.data_format == ("base64" if encoding else None)


@pytest.mark.parametrize("value", ["foo*bar", "foo'bar", "foo~bar", "foo%20bar", "foo%3Bbar"])
def test_data_uri_parameter_uses_parameter_token_alphabet(value):
result = DataUri.from_data_uri(f"data:text/plain;name={value},Hello")
assert result.data_bytes == b"Hello"
assert result.parameters == {"name": value}
6 changes: 6 additions & 0 deletions python/tests/unit/contents/test_image_content.py
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@ def test_create_data():
assert image.data == b"test_data"


def test_create_svg_data_uri():
image = ImageContent(data_uri="data:image/svg+xml;base64,PHN2Zy8+")
assert image.mime_type == "image/svg+xml"
assert image.data == b"<svg/>"


def test_to_str_uri():
image = ImageContent(uri="http://test_uri")
assert str(image) == "http://test_uri/"
Expand Down
Loading