fix: CustomVulnerabilityTemplate handles None purpose and special characters - #216
Open
frankentini wants to merge 1 commit into
Open
Conversation
…racters
Fix three bugs in CustomVulnerabilityTemplate:
1. _apply_template_variables crashes with AttributeError when purpose
is None because it calls purpose.strip() unconditionally.
2. _apply_template_variables substitutes {purpose} before str.format(),
so if purpose contains curly braces (e.g. JSON descriptions), the
subsequent .format() call raises KeyError or ValueError. Now purpose
is passed through str.format() like the other variables.
3. _generate_fallback_prompt renders literal 'None' in the output when
purpose is not provided. Now defaults to 'general assistant'.
Add 17 focused tests for the template module covering placeholder
substitution, None/empty/whitespace purpose, special characters in
user-supplied values, literal braces preservation, and fallback prompt
generation.
|
@frankentini is attempting to deploy a commit to the Confident AI Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
|
Hey @frankentini thanks for the fix! One thing I'd like to ask is can we not default to a general assistant purpose? This could lead to incorrectness in certain scnearios. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes three bugs in
CustomVulnerabilityTemplatethat cause crashes or incorrect output when usingCustomVulnerability:Bug 1:
AttributeErrorwhenpurposeisNone_apply_template_variablescallspurpose.strip()unconditionally, raisingAttributeError: 'NoneType' object has no attribute 'strip'whenpurposeis omitted.Bug 2:
KeyError/ValueErrorwhenpurposecontains curly bracesThe old code substituted
{purpose}directly into the template string before callingstr.format(). If the purpose contained curly braces (e.g."JSON parser {key: value}"), the subsequent.format()call would misinterpret them as format placeholders and crash.Fix:
{purpose}is now passed throughstr.format()like the other variables (name,type,max_goldens), so special characters in user-supplied values are handled safely.Bug 3: Literal
Nonerendered in fallback prompt_generate_fallback_promptused an f-string with{purpose}, rendering the literal string"None"when purpose was not provided. Now defaults to"general assistant".Tests
Added 17 focused unit tests covering:
None, empty, and whitespace-only purpose handlingAll tests pass:
Related
Partially addresses the template-related crash path described in #154 (
TypeError: can only join an iterablewith custom vulnerability).