Merge pull request from GHSA-x4x5-jv3x-9c7m

* restrict import path * add test
Qiskit · Mar 18, 2024 · b78fca1 · b78fca1
1 parent 1cba696
commit b78fca1
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 7 deletions.
diff --git a/qiskit_ibm_runtime/utils/json.py b/qiskit_ibm_runtime/utils/json.py
@@ -373,7 +373,9 @@ def object_hook(self, obj: Any) -> Any:
                 # to deserialize load qpy circuit and return first instruction object in that circuit.
                 circuit = _decode_and_deserialize(obj_val, load)[0]
                 return circuit.data[0][0]
-            if obj_type == "settings":
+            if obj_type == "settings" and obj["__module__"].startswith(
+                "qiskit.quantum_info.operators"
+            ):
                 return _deserialize_from_settings(
                     mod_name=obj["__module__"],
                     class_name=obj["__class__"],

diff --git a/test/unit/test_data_serialization.py b/test/unit/test_data_serialization.py
@@ -27,7 +27,7 @@
 from qiskit.circuit.library import EfficientSU2, CXGate, PhaseGate, U2Gate
 
 import qiskit.quantum_info as qi
-from qiskit.quantum_info import SparsePauliOp, Pauli, Statevector
+from qiskit.quantum_info import SparsePauliOp, Pauli
 from qiskit.result import Result, Counts
 from qiskit.primitives.containers.bindings_array import BindingsArray
 from qiskit.primitives.containers.observables_array import ObservablesArray
@@ -107,17 +107,18 @@ def test_coder_qc(self):
                     decoded = [decoded]
                 self.assertTrue(all(isinstance(item, QuantumCircuit) for item in decoded))
 
-    @skip("Skip until qiskit-ibm-provider/736 is merged")
     def test_coder_operators(self):
         """Test runtime encoder and decoder for operators."""
 
-        coeff_x = Parameter("x")
-        coeff_y = coeff_x + 1
+        # TODO: Re-enable use of Parameter when #1521 is fixed.
+        # coeff_x = Parameter("x")
+        # coeff_y = coeff_x + 1
 
         subtests = (
             SparsePauliOp(Pauli("XYZX"), coeffs=[2]),
-            SparsePauliOp(Pauli("XYZX"), coeffs=[coeff_y]),
+            # SparsePauliOp(Pauli("XYZX"), coeffs=[coeff_y]),
             SparsePauliOp(Pauli("XYZX"), coeffs=[1 + 2j]),
+            Pauli("XYZ"),
         )
 
         for operator in subtests:
@@ -224,7 +225,7 @@ def test_decoder_import(self):
 
         subtests = (
             SparsePauliOp(Pauli("XYZX"), coeffs=[2]),
-            Statevector([1, 0]),
+            Pauli("XYZX"),
         )
         for operator in subtests:
             with self.subTest(operator=operator):
@@ -531,3 +532,18 @@ def test_primitive_result(self):
             decoded = json.loads(encoded, cls=RuntimeDecoder)["primitive_result"]
             self.assertIsInstance(decoded, PrimitiveResult)
             self.assert_primitive_results_equal(primitive_result, decoded)
+
+    def test_unknown_settings(self):
+        """Test settings not on whitelisted path."""
+        random_settings = {
+            "__type__": "settings",
+            "__module__": "subprocess",
+            "__class__": "Popen",
+            "__value__": {
+                "args": ["echo", "hi"]
+            }
+        }
+        encoded = json.dumps(random_settings)
+        decoded = json.loads(encoded, cls=RuntimeDecoder)
+        self.assertIsInstance(decoded, dict)
+        self.assertDictEqual(decoded, random_settings)