Qiskit / qiskit
88%
main: 88%

LAST BUILD BRANCH: licence-metadata
DEFAULT BRANCH: main
Repo Added
Files 871
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH gh-readonly-queue/main/pr-14024-a5c33a8aa3face520c3819520441f0f4f2c996ee
branch: gh-readonly-queue/main/pr-14024-a5c33a8aa3face520c3819520441f0f4f2c996ee
CHANGE BRANCH
x

coverage: 88.086% (-0.03%) from 88.117%
13896784551

push

github

web-flow 
Introduce custom sympy srepr parser (#14024)

* Introduce custom sympy srepr parser

This commit introduces a custom parser to QPY for parameter expression
payloads that were generated using sympy. Prior to QPY version 10 this
was the only way we supported serializing parameter expressions in QPY.
For QPY version 10, 11, and 12 sympy could optionally be used if the
payload was generated explicitly to not use symengine (in qiskit 1.0 it
defaulted to use symengine).
This serialization format relied on sympy to generate a string
representation of the expression which we then put in the payload. On
deserialization we called sympy's `parse_expr()` function which
internally is calling sympy's `sympify()` internally. Sympy documents
that `sympify()` relies on Python's `eval()` for string input and
should not be used with untrusted input. But `parse_expr()` didn't have
such a warning (at the time, I plan to contribute adding one), so
using this function provides an avenue for arbitrary code execution
during QPY deserialization.

This commit fixes this issue by writing a custom parser for the string
repesentation in a QPY payload based on python's ast module. This parser
walks the abstract syntax tree and builds the sympy expression object as
it it goes. It is restricted to the operations that
`ParameterExpression` supports and if any part of the string tries to
use functionality outside that set it will error.

* Simplify visitor logic

* Fix lint

* Add sanity checks that we only call sympify if coming from symengine

* Apply suggestions from code review

Co-authored-by: Elena Peña Tapia <57907331+ElePT@users.noreply.github.com>

---------

Co-authored-by: Elena Peña Tapia <57907331+ElePT@users.noreply.github.com>

17 of 60 new or added lines in 5 files covered. (28.33%)

5 existing lines in 2 files now uncovered.

72728 of 82565 relevant lines covered (88.09%)

357347.35 hits per line

Relevant lines Covered
82565 RELEVANT LINES 72728 COVERED LINES
357347.35 HITS PER LINE
Source Files on gh-readonly-queue/main/pr-14024-a5c33a8aa3face520c3819520441f0f4f2c996ee

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
13896784551 gh-readonly-queue/main/pr-14024-a5c33a8aa3face520c3819520441f0f4f2c996ee Introduce custom sympy srepr parser (#14024) * Introduce custom sympy srepr parser This commit introduces a custom parser to QPY for parameter expression payloads that were generated using sympy. Prior to QPY version 10 this was the only way we ... push web-flow github
88.09
See All Builds (13949)