diff --git a/lib/crewai-tools/src/crewai_tools/tools/rag/rag_tool.py b/lib/crewai-tools/src/crewai_tools/tools/rag/rag_tool.py index 366ae76bb..5942407d9 100644 --- a/lib/crewai-tools/src/crewai_tools/tools/rag/rag_tool.py +++ b/lib/crewai-tools/src/crewai_tools/tools/rag/rag_tool.py @@ -267,7 +267,11 @@ class RagTool(BaseTool): validated_args: list[ContentItem] = [] for arg in args: - source_ref = str(arg.get("source", arg.get("content", ""))) if isinstance(arg, dict) else str(arg) + source_ref = ( + str(arg.get("source", arg.get("content", ""))) + if isinstance(arg, dict) + else str(arg) + ) # Check if it's a URL — only catch urlparse-specific errors here; # validate_url's ValueError must propagate so it is never silently bypassed. @@ -285,7 +289,11 @@ class RagTool(BaseTool): continue # Check if it looks like a file path (not a plain text string) - if os.path.sep in source_ref or source_ref.startswith(".") or os.path.isabs(source_ref): + if ( + os.path.sep in source_ref + or source_ref.startswith(".") + or os.path.isabs(source_ref) + ): try: validate_file_path(source_ref) except ValueError as e: diff --git a/lib/crewai-tools/src/crewai_tools/utilities/safe_path.py b/lib/crewai-tools/src/crewai_tools/utilities/safe_path.py index 0c5f56605..e3c2ff54b 100644 --- a/lib/crewai-tools/src/crewai_tools/utilities/safe_path.py +++ b/lib/crewai-tools/src/crewai_tools/utilities/safe_path.py @@ -31,6 +31,7 @@ def _is_escape_hatch_enabled() -> bool: # File path validation # --------------------------------------------------------------------------- + def validate_file_path(path: str, base_dir: str | None = None) -> str: """Validate that a file path is safe to read. @@ -59,10 +60,15 @@ def validate_file_path(path: str, base_dir: str | None = None) -> str: base_dir = os.getcwd() resolved_base = os.path.realpath(base_dir) - resolved_path = os.path.realpath(os.path.join(resolved_base, path) if not os.path.isabs(path) else path) + resolved_path = os.path.realpath( + os.path.join(resolved_base, path) if not os.path.isabs(path) else path + ) # Ensure the resolved path is within the base directory - if not resolved_path.startswith(resolved_base + os.sep) and resolved_path != resolved_base: + if ( + not resolved_path.startswith(resolved_base + os.sep) + and resolved_path != resolved_base + ): raise ValueError( f"Path '{path}' resolves to '{resolved_path}' which is outside " f"the allowed directory '{resolved_base}'. " diff --git a/lib/crewai/src/crewai/cli/cli.py b/lib/crewai/src/crewai/cli/cli.py index b0483d570..c40fe656f 100644 --- a/lib/crewai/src/crewai/cli/cli.py +++ b/lib/crewai/src/crewai/cli/cli.py @@ -609,7 +609,6 @@ def env() -> None: @env.command("view") def env_view() -> None: """View tracing-related environment variables.""" - import os from pathlib import Path from rich.console import Console @@ -738,7 +737,6 @@ def traces_disable() -> None: @traces.command("status") def traces_status() -> None: """Show current trace collection status.""" - import os from rich.console import Console from rich.panel import Panel diff --git a/lib/crewai/src/crewai/tasks/llm_guardrail.py b/lib/crewai/src/crewai/tasks/llm_guardrail.py index 3cbd20c65..754596ab7 100644 --- a/lib/crewai/src/crewai/tasks/llm_guardrail.py +++ b/lib/crewai/src/crewai/tasks/llm_guardrail.py @@ -1,6 +1,6 @@ import asyncio -import concurrent.futures from collections.abc import Coroutine +import concurrent.futures import contextvars import inspect from typing import Any