PatchWork AutoFix

[patched-admin]

This pull request from patched fixes 6 issues.

---

• File changed: patchwork/common/tools/csvkit_tool.py
  Use parameterized queries to prevent SQL injection

  This change replaces the untrusted input in the SQL query with parameterized queries to prevent SQL injection vulnerabilities by using the ? placeholder.

• File changed: patchwork/common/utils/step_typing.py
  Restrict importlib.import_module to trusted modules only

  Restricted dynamic module imports using a whitelist approach to prevent the execution of untrusted code.

• File changed: patchwork/app.py
  Implement module path whitelisting to prevent arbitrary code execution

  The code is updated to use a whitelist of allowed module paths. This prevents the importlib.import_module() and importlib.util.spec_from_file_location() functions from loading untrusted code by ensuring only pre-approved modules can be imported.

• File changed: patchwork/common/tools/bash_tool.py
  Refactor subprocess call to prevent shell injection vulnerability

  Modified the subprocess.run call to set shell=False and split the command string into a list of arguments. This prevents shell injection vulnerabilities by ensuring the command execution does not rely on the shell environment.

• File changed: patchwork/steps/CallShell/CallShell.py
  Remove use of 'shell=True' for subprocess.run to improve security

  The subprocess.run call has been modified to use 'shell=False'. The command to be executed is passed as a list instead of a string to avoid shell injection vulnerabilities.

• File changed: patchwork/common/utils/dependency.py
  Add whitelist to restrict modules that can be imported dynamically

  The code was updated to use a whitelist of allowed module names for dynamic importation, preventing arbitrary code execution through untrusted user input.