Skip to content

Python: Add class validation for Dapr Runtime step loading#13499

Merged
moonbox3 merged 2 commits intomicrosoft:mainfrom
moonbox3:dapr-state-store
Feb 2, 2026
Merged

Python: Add class validation for Dapr Runtime step loading#13499
moonbox3 merged 2 commits intomicrosoft:mainfrom
moonbox3:dapr-state-store

Conversation

@moonbox3
Copy link
Copy Markdown
Collaborator

Motivation and Context

The Dapr Runtime uses string-based class names to load step classes dynamically. This PR adds validation to ensure that only valid KernelProcessStep subclasses can be loaded and instantiated, improving type safety and providing better error messages when misconfigured.

The new allowed_module_prefixes parameter gives users control over which modules are permitted for step class loading, which can be useful in environments where stricter control is desired.

Description

  • Add issubclass(cls, KernelProcessStep) validation when loading step classes from qualified names
  • Add optional allowed_module_prefixes parameter for restricting which modules can be loaded
  • Centralize class loading logic in get_step_class_from_qualified_name() utility function
  • Remove duplicate _get_class_from_string methods from DaprStepInfo and StepActor

Contribution Checklist

@moonbox3 moonbox3 self-assigned this Jan 30, 2026
@moonbox3 moonbox3 requested a review from a team as a code owner January 30, 2026 21:29
@moonbox3 moonbox3 added the python Pull requests for the Python Semantic Kernel label Jan 30, 2026
@moonbox3
Copy link
Copy Markdown
Collaborator Author

Python Test Coverage

Python Test Coverage Report •
FileStmtsMissCoverMissing
processes
   step_utils.py510100% 
processes/dapr_runtime
   dapr_process_info.py32487%32, 37, 47, 54
   dapr_step_info.py26196%47
processes/dapr_runtime/actors
   step_actor.py2656176%104, 107, 111–112, 124–126, 170–173, 191, 195, 199, 225, 233–234, 250–252, 255–260, 263–265, 272–273, 287, 291–293, 296–297, 314, 331–332, 337, 368–370, 390, 430, 442–450, 453, 456–460
TOTAL28147482182% 

Python Unit Test Overview

Tests Skipped Failures Errors Time
3833 23 💤 0 ❌ 0 🔥 1m 48s ⏱️

@moonbox3 moonbox3 added this pull request to the merge queue Jan 30, 2026
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Jan 30, 2026
@moonbox3 moonbox3 merged commit b6f95e2 into microsoft:main Feb 2, 2026
28 checks passed
moonbox3 added a commit that referenced this pull request Mar 24, 2026
### Motivation and Context

Follow-up to #13499. The previous PR added the `allowed_module_prefixes`
parameter but defaulted it to `None`, which meant the module restriction
was only active if developers discovered and configured it.
Secure-by-default is the right posture here — restrict first, let
developers widen as needed.

- Change `allowed_module_prefixes` default from `None` to
`("semantic_kernel.",)` across Dapr runtime step loading
- Non-SK step classes now require developers to explicitly add their
module prefix (e.g. `("semantic_kernel.", "myapp.steps.")`)
- Developers can pass `None` to opt out entirely, but the secure default
is now enforced
- The Dapr runtime code is experimental, so this is a non-breaking
change per our stability guarantees

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

---------

Co-authored-by: MAF Dashboard Bot <maf-dashboard-bot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

python Pull requests for the Python Semantic Kernel

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants