Add ManageEngineAgent

[whoisarpit]

PR Checklist

• The commit message follows our guidelines: Code of conduct
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)
• Does this PR introduce a breaking change?
• Include PR in release notes?

PR Type

• Bugfix
• Feature
• Refactoring
• Build /CI
• Documentation
• Others

What is the current behavior?

Issue Number: N/A

What is the new behavior?

Other information

[CTY-git]

lgtm

[patched-admin]

File Changed: patchwork/common/tools/__init__.py

Rule 2: Do not overlook possible security vulnerabilities

Details: The addition of APIRequestTool warrants security consideration. While the import itself doesn't introduce direct vulnerabilities, the inclusion of an API request tool should be noted for security review. The tool's implementation should be reviewed separately to ensure proper security measures (authentication, input validation, request sanitization) are in place.

Affected Code Snippet:

from patchwork.common.tools.api_tool import APIRequestTool

Start Line: 4

End Line: 4

File Changed: patchwork/common/tools/api_tool.py

Rule 1: Do not ignore potential bugs in the code

Details: The code contains a potential bug in the headers initialization. The default value for headers parameter is using a mutable default argument (empty dict) which can lead to unexpected behavior if the same instance is reused.

Affected Code Snippet:

def __init__(
    self,
    headers: Optional[Dict[str, str]] = dict(),  # Mutable default argument
    username: Optional[str] = None,
    password: Optional[str] = None,
    preprocess_data: Callable[[str], str] = lambda x: x,
    **kwargs,
):

Start Line: 11
End Line: 19

Details: Another potential bug exists in the error response handling where response headers might contain sensitive information but are included in the error output without filtering.

Affected Code Snippet:

header_string = "\n".join(
    f"{key}: {value}" for key, value in headers.items()
)

return (
    f"HTTP/{response.raw.version / 10:.1f} {status_code} {response.reason}\n"
    f"{header_string}\n"
    f"\n"
    f"{response_text}"
)

Start Line: 91
End Line: 99

Rule 2: Do not overlook possible security vulnerabilities

Details: The code has several security concerns:

1. Password is stored in plain text as instance variable
2. No input validation for URL (could lead to SSRF)
3. Error responses include full headers which might expose sensitive information
4. No timeout setting for requests which could lead to DoS

Affected Code Snippet:

def __init__(
    self,
    headers: Optional[Dict[str, str]] = dict(),
    username: Optional[str] = None,
    password: Optional[str] = None,
    preprocess_data: Callable[[str], str] = lambda x: x,
    **kwargs,
):
    self._headers = headers
    self._auth = (username, password) if username and password else None
    self._preprocess_data = preprocess_data

Start Line: 11
End Line: 19

File Changed: patchwork/steps/BrowserUse/BrowserUse.py

Rule 1: Do not ignore potential bugs in the code

Details: Potential bug detected - The code introduces mustache_render function with two parameters but there's no validation or error handling for the case when task_value might be None or incompatible with the template.

Affected Code Snippet:

task=mustache_render(self.inputs["task"], self.inputs["task_value"])

Start Line: 182
End Line: 182

---

Rule 2: Do not overlook possible security vulnerabilities

Details: Security vulnerability detected - The use of mustache templating with unsanitized input from self.inputs["task_value"] could potentially lead to template injection attacks if the input is not properly validated.

Affected Code Snippet:

task=mustache_render(self.inputs["task"], self.inputs["task_value"])

Start Line: 182
End Line: 182

Recommendations:

1. Add input validation for task_value before passing it to mustache_render
2. Implement proper error handling for the template rendering
3. Consider implementing template value sanitization to prevent injection attacks
4. Document the expected format of task_value and any restrictions on its content

File Changed: patchwork/steps/BrowserUse/typed.py

Rule 1: Do not ignore potential bugs in the code

Details: The change introduces a potential bug by making task_value a required field in __BrowserUseInputsRequired while removing validation constraints. The Dict[str, Any] type is too permissive and could lead to runtime errors if specific dictionary structure is expected.

Affected Code Snippet:

class __BrowserUseInputsRequired(TypedDict):
    task: str
    task_value: Dict[str, Any]

Start Line: 7
End Line: 9

Rule 2: Do not overlook possible security vulnerabilities

Details: The modification removes the is_config=True flag from the API key annotations, which might affect how these sensitive credentials are handled in the configuration. This could potentially lead to security issues if the configuration handling relies on this flag for proper credential management.

Affected Code Snippet:

    openai_api_key: Annotated[str, StepTypeConfig(or_op=["google_api_key", "anthropic_api_key"])]
    anthropic_api_key: Annotated[str, StepTypeConfig(or_op=["google_api_key", "openai_api_key"])]
    google_api_key: Annotated[str, StepTypeConfig(or_op=["openai_api_key", "anthropic_api_key"])]

Start Line: 13
End Line: 15

File Changed: patchwork/steps/GitHubAgent/GitHubAgent.py

Rule 1: Do not ignore potential bugs in the code

Details: Potential bug identified in the modified code. The inputs.get("prompt_value", {}) provides an empty dictionary as default, but there's no validation to ensure that the data structure passed to mustache_render contains the required fields for the template defined in inputs["task"]. This could lead to runtime errors if template variables are not found in the data dictionary.

Affected Code Snippet:

data = inputs.get("prompt_value", {})
task = mustache_render(inputs["task"], data)

Start Line: 17
End Line: 18

---

Rule 2: Do not overlook possible security vulnerabilities

Details: Security vulnerability identified. Using mustache_render with unvalidated input data could lead to template injection vulnerabilities. The code doesn't sanitize or validate the content of inputs["task"] or the prompt_value dictionary before passing them to the template renderer, which could potentially allow for malicious template manipulation.

Affected Code Snippet:

data = inputs.get("prompt_value", {})
task = mustache_render(inputs["task"], data)

Start Line: 17
End Line: 18

File Changed: patchwork/steps/GitHubAgent/typed.py

Rule 1: Do not ignore potential bugs in the code

Details: Potential bug identified - Missing required field validation. The code changes introduce a required field 'task' in __GitHubAgentRequiredInputs but removes previously required fields 'system_prompt' and 'user_prompt' without proper migration strategy or documentation.

Affected Code Snippet:

-class GitHubAgentInputs(TypedDict, total=False):
+class __GitHubAgentRequiredInputs(TypedDict):
+    task: str
+
+class GitHubAgentInputs(__GitHubAgentRequiredInputs, total=False):
    base_path: str
    prompt_value: Dict[str, Any]
-    system_prompt: str
-    user_prompt: str

Start Line: 6
End Line: 13

---

Rule 2: Do not overlook possible security vulnerabilities introduced by code modifications

Details: Security concern identified - The removed fields 'system_prompt' and 'user_prompt' might have contained security-related validation or sanitization. Their removal without clear replacement strategy could lead to potential injection vulnerabilities through the new 'task' field.

Affected Code Snippet:

-    system_prompt: str
-    user_prompt: str
+    task: str

Start Line: 8
End Line: 10

File Changed: patchwork/steps/ManageEngineAgent/ManageEngineAgent.py

Rule 1 - Potential Bugs
Details: The code does not validate the response from make_api_request tool and assumes the API call will always succeed. There's no error handling for failed API requests or invalid responses.

Affected Code Snippet:

    def run(self) -> dict:
        # Execute the agentic strategy
        result = self.agentic_strategy.execute(limit=self.conversation_limit)

        # Return results with usage information
        return {**result, **self.agentic_strategy.usage()}

Start Line: 69
End Line: 75

---

Rule 2 - Security Vulnerabilities
Details: The code exposes potential security vulnerabilities in several areas:

1. The OAuth token is passed directly in headers without validation
2. No input sanitization for user_prompt and prompt_value before rendering
3. The preprocess_data lambda function could potentially allow injection attacks through unvalidated input

Affected Code Snippet:

        self.headers = {
            "Authorization": f"Zoho-oauthtoken {inputs.get('me_access_token')}",
            "Content-Type": "application/x-www-form-urlencoded",
            "Accept": "application/vnd.manageengine.sdp.v3+json",
        }

        # ... later in the code ...
        user_prompt_template=mustache_render(inputs.get("user_prompt"), inputs.get("prompt_value")),
        # ... and ...
        make_api_request=APIRequestTool(
            headers=self.headers,
            preprocess_data=lambda x: f"input_data={x}",
        )

Start Line: 30
End Line: 51

File Changed: patchwork/steps/ManageEngineAgent/typed.py

Rule 1: Do not ignore potential bugs in the code

Details: Potential bug found in the implementation of the API key configuration. The or_op validation could allow a state where no API key is provided, as there's no explicit requirement that at least one must be present.

Affected Code Snippet:

    openai_api_key: Annotated[str, StepTypeConfig(or_op=["google_api_key", "anthropic_api_key"])]
    anthropic_api_key: Annotated[str, StepTypeConfig(or_op=["google_api_key", "openai_api_key"])]
    google_api_key: Annotated[str, StepTypeConfig(or_op=["openai_api_key", "anthropic_api_key"])]

Start Line: 13
End Line: 15

---

Rule 2: Do not overlook possible security vulnerabilities

Details: Security vulnerability detected in handling of API keys. The TypedDict structure exposes sensitive API keys in the type definition without any indication of secure handling or encryption requirements.

Affected Code Snippet:

    openai_api_key: Annotated[str, StepTypeConfig(or_op=["google_api_key", "anthropic_api_key"])]
    anthropic_api_key: Annotated[str, StepTypeConfig(or_op=["google_api_key", "openai_api_key"])]
    google_api_key: Annotated[str, StepTypeConfig(or_op=["openai_api_key", "anthropic_api_key"])]

Start Line: 13
End Line: 15

File Changed: patchwork/steps/__init__.py

Rule 2: Do not overlook possible security vulnerabilities

Details: Importing a new agent (ManageEngineAgent) could potentially introduce security vulnerabilities if the module has access to sensitive ManageEngine systems or credentials. A security review of the ManageEngineAgent implementation is recommended to ensure proper credential handling and secure API communications.

Affected Code Snippet:

from patchwork.steps.ManageEngineAgent.ManageEngineAgent import ManageEngineAgent

Start Line: 36

End Line: 36