Question

安全问题

我最近一直在与Rasa玩耍，并将MongoDB作为其背后的数据库。

我想知道是否应该以某种方式预处理对Rasa的输入以防止NoSQL注入？我曾尝试将自定义组件作为Rasa NLU管道的一部分，但是一旦碰到了NLU管道的第一个元素，似乎原始文本也会保存在Mongo中。

domain_file

language: "de"

pipeline:
- name: "nlu_components.length_limiter.LengthLimiter"
- name: "tokenizer_whitespace"
- name: "intent_entity_featurizer_regex"
- name: "ner_crf"
- name: "ner_synonyms"
- name: "intent_featurizer_count_vectors"
- name: "intent_classifier_tensorflow_embedding"

length_limiter.py-注意“处理”方法

from rasa_nlu.components import Component


MAX_LENGTH = 300


class LengthLimiter(Component):
"""
This component shortens the input message to MAX_LENGTH chars
in order to prevent overloading the bot

"""

# Name of the component to be used when integrating it in a
# pipeline. E.g. ``[ComponentA, ComponentB]``
# will be a proper pipeline definition where ``ComponentA``
# is the name of the first component of the pipeline.
name = "LengthLimiter"

# Defines what attributes the pipeline component will
# provide when called. The listed attributes
# should be set by the component on the message object
# during test and train, e.g.
# ```message.set("entities", [...])```
provides = []

# Which attributes on a message are required by this
# component. e.g. if requires contains "tokens", than a
# previous component in the pipeline needs to have "tokens"
# within the above described `provides` property.
requires = []

# Defines the default configuration parameters of a component
# these values can be overwritten in the pipeline configuration
# of the model. The component should choose sensible defaults
# and should be able to create reasonable results with the defaults.
defaults = {
    "MAX_LENGTH": 300
}

# Defines what language(s) this component can handle.
# This attribute is designed for instance method: `can_handle_language`.
# Default value is None which means it can handle all languages.
# This is an important feature for backwards compatibility of components.
language_list = None

def __init__(self, component_config=None):
    super(LengthLimiter, self).__init__(component_config)

def train(self, training_data, cfg, **kwargs):
    """Train this component.

    This is the components chance to train itself provided
    with the training data. The component can rely on
    any context attribute to be present, that gets created
    by a call to :meth:`components.Component.pipeline_init`
    of ANY component and
    on any context attributes created by a call to
    :meth:`components.Component.train`
    of components previous to this one."""
    pass

def process(self, message, **kwargs):
    """Process an incoming message.

    This is the components chance to process an incoming
    message. The component can rely on
    any context attribute to be present, that gets created
    by a call to :meth:`components.Component.pipeline_init`
    of ANY component and
    on any context attributes created by a call to
    :meth:`components.Component.process`
    of components previous to this one."""

    message.text = message.text[:self.defaults["MAX_LENGTH"]]

def persist(self, model_dir):
    """Persist this component to disk for future loading."""

    pass

@classmethod
def load(cls, model_dir=None, model_metadata=None, cached_component=None,
         **kwargs):
    """Load this component from file."""

    if cached_component:
        return cached_component
    else:
        component_config = model_metadata.for_component(cls.name)
        return cls(component_config)

Answer 1

我在mongo追踪器商店附近玩耍，无法注入任何东西。但是，如果您要添加自己的组件来绝对确定，则必须实现own input channel。在Rasa Core处理消息之前，您可以在那里更改消息。

使用Rasa进行NoSQL注入

1 个答案: