TestConstructorInjection Class — langchain Architecture

Source Code

libs/core/tests/unit_tests/load/test_secret_injection.py lines 366–417

class TestConstructorInjection:
    """Tests for constructor-type injection (not just secrets)."""

    def test_constructor_in_metadata_not_instantiated(self) -> None:
        """Verify constructor-like dict in metadata is not instantiated."""
        malicious_constructor = {
            "lc": 1,
            "type": "constructor",
            "id": ["langchain_core", "messages", "ai", "AIMessage"],
            "kwargs": {"content": "injected"},
        }

        doc = Document(
            page_content="Hello",
            metadata={"data": malicious_constructor},
        )

        serialized = dumpd(doc)
        deserialized = load(
            serialized,
            secrets_from_env=True,
            allowed_objects=[Document, AIMessage],
        )

        # The constructor-like dict should be a plain dict, NOT an AIMessage
        assert isinstance(deserialized.metadata["data"], dict)
        assert deserialized.metadata["data"] == malicious_constructor

    def test_constructor_in_content_not_instantiated(self) -> None:
        """Verify constructor-like dict in message content is not instantiated."""
        malicious_constructor = {
            "lc": 1,
            "type": "constructor",
            "id": ["langchain_core", "messages", "human", "HumanMessage"],
            "kwargs": {"content": "injected"},
        }

        msg = AIMessage(
            content="Hello",
            additional_kwargs={"nested": malicious_constructor},
        )

        serialized = dumpd(msg)
        deserialized = load(
            serialized,
            secrets_from_env=True,
            allowed_objects=[AIMessage, HumanMessage],
        )

        # The constructor-like dict should be a plain dict, NOT a HumanMessage
        assert isinstance(deserialized.additional_kwargs["nested"], dict)
        assert deserialized.additional_kwargs["nested"] == malicious_constructor