Prevent arbitrary code execution when a malicious server sends a crafted error response with a non-feast module name.
The fix adds a prefix check ensuring only feast.* modules can be imported during error deserialization, with tests for non-feast rejection and legitimate feast errors.
Signed-off-by: dfgvaetyj3456356-hash <dfgvaetyj3456356-hash@users.noreply.github.com>
This PR fixes a client-side remote code execution vulnerability in FeastError.from_error_detail().
CWE: CWE-94 (Code Injection)
File: sdk/python/feast/errors.py
FeastError.from_error_detail() used importlib.import_module() on an untrusted module field received from a server response. A malicious or compromised Feast server could send an error detail like {"module": "os", "class": "system", "message": "pwned"}, causing arbitrary module import and code execution on the client.
Fix: Restrict module_name to feast.* prefix only. Non-feast modules are rejected with a warning and return None.
Test: Added test_error_detail_blocks_non_feast_module() verifying that malicious non-feast modules are blocked.