fix(platform): avoid agent input value export, handling marketplace redirection, agent store fixes #9147

Swiftyos · 2024-12-30T13:39:17Z

Changes 🏗️

Redirect to the marketplace.
Ensure that the store agent uses agent graph data instead of store listing data.
Don’t export agent input values.
URL sanitization: We can’t open an agent if it has a colon in its name.
Show all top agents.

Checklist 📋

For code changes:

I have clearly listed my changes in the PR description
I have made a test plan
I have tested my changes according to the test plan:
- ...

Example test plan

Create from scratch and execute an agent with at least 3 blocks
Import an agent from file upload, and confirm it executes correctly
Upload agent to marketplace
Import an agent from marketplace and confirm it executes correctly
Edit an agent from monitor, and confirm it executes correctly

For configuration changes:

.env.example is updated or already compatible with my changes
docker-compose.yml is updated or already compatible with my changes
I have included a list of my configuration changes in the PR description (under Changes)

Examples of configuration changes

Changing ports
Adding new services that need to communicate with each other
Secrets or environment variable changes
New or infrastructure changes such as databases

netlify · 2024-12-30T13:39:34Z

✅ Deploy Preview for auto-gpt-docs-dev canceled.

Name	Link
🔨 Latest commit	`ba0b0be`
🔍 Latest deploy log	https://app.netlify.com/sites/auto-gpt-docs-dev/deploys/6772abd9b88d11000818121e

qodo-merge-pro · 2024-12-30T13:39:40Z

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🧪 No relevant tests
🔒 Security concerns SQL injection: The search query sanitization in db.py only checks length and strips whitespace, but does not properly escape special SQL characters. This could potentially allow SQL injection attacks if the sanitization in line 38 is not properly implemented.
⚡ Recommended focus areas for review Error Handling The new error handling approach returns JSON responses instead of raising exceptions, which could mask underlying issues and make debugging harder. Consider logging the full exception details before returning the generic error responses. logger.exception("Exception occurred whilst getting user profile") return fastapi.responses.JSONResponse( status_code=500, content={"detail": "An error occurred while retrieving the user profile"}, ) Input Validation The username and slug sanitization logic removes all non-alphanumeric characters except hyphens. This could potentially cause collisions if different usernames/slugs map to the same sanitized value. slug = "".join( c if c.isalpha() or c == "-" or c.isnumeric() else "" for c in slug ).lower()

netlify · 2024-12-30T13:40:42Z

✅ Deploy Preview for auto-gpt-docs canceled.

Name	Link
🔨 Latest commit	`ba0b0be`
🔍 Latest deploy log	https://app.netlify.com/sites/auto-gpt-docs/deploys/6772abd9e72e3e0008d14d8d

autogpt_platform/backend/backend/server/v2/store/routes.py

ntindle · 2024-12-30T13:42:35Z

That slugifier message above is valid if we allow any other characters so I'd recommend taking a look at it

ntindle · 2024-12-30T13:44:00Z

We could also just generate the slugs we want and check if they already exist rather than requiring the user to pass them in

Swiftyos · 2024-12-30T13:51:54Z

We could also just generate the slugs we want and check if they already exist rather than requiring the user to pass them in

The idea was around SEO, however I see no issue with just auto generating it from the agent name (store listing name).

Swiftyos · 2024-12-30T13:55:20Z

That slugifier message above is valid if we allow any other characters so I'd recommend taking a look at it

The AI hasn't understood the code correctly. The search query is sanitized by having all sql lang special characters escaped.

Also the slug is sanitized prior to saving it, however we are missing a unique constraint on the slug.

…ption Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

…oGPT into hotfix-new-year

majdyz · 2024-12-30T14:57:40Z

autogpt_platform/backend/backend/server/v2/store/routes.py

@@ -37,20 +41,24 @@ async def get_profile(
        return profile
    except Exception:
        logger.exception("Exception occurred whilst getting user profile")
-        raise
+        return fastapi.responses.JSONResponse(


Is this actually needed? There is already handle_internal_http_error in rest_api.py, are the v2 routes no longer using it?

majdyz · 2024-12-30T14:57:47Z

autogpt_platform/backend/backend/server/v2/store/routes.py

@@ -71,15 +79,22 @@ async def update_or_create_profile(
        return updated_profile
    except Exception:
        logger.exception("Exception occurred whilst updating profile")
-        raise
+        return fastapi.responses.JSONResponse(


majdyz · 2024-12-30T14:58:59Z

autogpt_platform/backend/migrations/20241230102007_update_store_agent_view/migration.sql

@@ -0,0 +1,50 @@
+BEGIN;


need to have a comment here just like the other migration file

majdyz · 2024-12-30T15:00:37Z

autogpt_platform/frontend/src/app/store/agent/[creator]/[slug]/page.tsx

@@ -40,7 +40,8 @@ export default async function Page({
  const agent = await api.getStoreAgent(creator_lower, params.slug);
  const otherAgents = await api.getStoreAgents({ creator: creator_lower });
  const similarAgents = await api.getStoreAgents({
-    search_query: agent.categories[0],
+    // We are using slug as we know its has been sanitized and is not null


nit: it has been, "and is not null" is inferred on the code too.
Maybe the comment is not needed?

majdyz · 2024-12-30T15:01:14Z

autogpt_platform/frontend/src/components/agptui/composite/AgentsSection.tsx

@@ -34,8 +34,8 @@ export const AgentsSection: React.FC<AgentsSectionProps> = ({
 }) => {
  const router = useRouter();

-  // Take only the first 9 agents
-  const displayedAgents = allAgents.slice(0, 9);
+  // TODO: Update this when we have pagination


Can we add more clarity? Update this to what?

Swiftyos added 6 commits December 30, 2024 11:27

add redirect from marketplace

c57dbf3

Remove agent input values on exporting an agent

a949dfc

update StoreAgent View to use slv.name rather than agent graph name

d3cfea5

remove limiting of top agents display

f64412b

url sanitisation

dfb4676

fix similar agent query

f780323

Swiftyos requested a review from a team as a code owner December 30, 2024 13:39

Swiftyos requested review from ntindle and aarushik93 and removed request for a team December 30, 2024 13:39

github-actions bot added platform/frontend AutoGPT Platform - Front end platform/backend AutoGPT Platform - Back end labels Dec 30, 2024

github-actions bot added the size/l label Dec 30, 2024

qodo-merge-pro bot added the Review effort [1-5]: 3 label Dec 30, 2024

github-advanced-security bot found potential problems Dec 30, 2024

View reviewed changes

autogpt_platform/backend/backend/server/v2/store/routes.py Fixed Show fixed Hide fixed

autogpt_platform/backend/backend/server/v2/store/routes.py Fixed Show fixed Hide fixed

Swiftyos and others added 6 commits December 30, 2024 14:55

Fix code scanning alert no. 112: Information exposure through an exce…

679e28c

…ption Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 113: Information exposure through an exce…

05d6543

…ption Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

skip tests that dont have mocker implemented

f606f74

remove incorrect type annotation

a5b7317

Merge branch 'hotfix-new-year' of github.com:Significant-Gravitas/Aut…

de56a42

…oGPT into hotfix-new-year

fmt

ba0b0be

Swiftyos merged commit 763284e into dev Dec 30, 2024
22 checks passed

Swiftyos deleted the hotfix-new-year branch December 30, 2024 15:04

majdyz changed the title ~~Hotfix new year~~ fix(platform): avoid agent input value export, handling marketplace redirection, agent store fixes Dec 30, 2024

majdyz reviewed Dec 30, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(platform): avoid agent input value export, handling marketplace redirection, agent store fixes #9147

fix(platform): avoid agent input value export, handling marketplace redirection, agent store fixes #9147

Swiftyos commented Dec 30, 2024 •

edited

Loading

netlify bot commented Dec 30, 2024 •

edited

Loading

qodo-merge-pro bot commented Dec 30, 2024

netlify bot commented Dec 30, 2024 •

edited

Loading

ntindle commented Dec 30, 2024 •

edited

Loading

ntindle commented Dec 30, 2024

Swiftyos commented Dec 30, 2024

Swiftyos commented Dec 30, 2024

majdyz Dec 30, 2024

majdyz Dec 30, 2024

majdyz Dec 30, 2024

majdyz Dec 30, 2024

majdyz Dec 30, 2024

fix(platform): avoid agent input value export, handling marketplace redirection, agent store fixes #9147

fix(platform): avoid agent input value export, handling marketplace redirection, agent store fixes #9147

Conversation

Swiftyos commented Dec 30, 2024 • edited Loading

Changes 🏗️

Checklist 📋

For code changes:

For configuration changes:

netlify bot commented Dec 30, 2024 • edited Loading

✅ Deploy Preview for auto-gpt-docs-dev canceled.

qodo-merge-pro bot commented Dec 30, 2024

PR Reviewer Guide 🔍

netlify bot commented Dec 30, 2024 • edited Loading

✅ Deploy Preview for auto-gpt-docs canceled.

ntindle commented Dec 30, 2024 • edited Loading

ntindle commented Dec 30, 2024

Swiftyos commented Dec 30, 2024

Swiftyos commented Dec 30, 2024

majdyz Dec 30, 2024

Choose a reason for hiding this comment

majdyz Dec 30, 2024

Choose a reason for hiding this comment

majdyz Dec 30, 2024

Choose a reason for hiding this comment

majdyz Dec 30, 2024

Choose a reason for hiding this comment

majdyz Dec 30, 2024

Choose a reason for hiding this comment

Swiftyos commented Dec 30, 2024 •

edited

Loading

netlify bot commented Dec 30, 2024 •

edited

Loading

netlify bot commented Dec 30, 2024 •

edited

Loading

ntindle commented Dec 30, 2024 •

edited

Loading