PatchWork AutoFix

[patched-admin]

This pull request from patched fixes 6 issues.

---

• File changed: patchwork/common/tools/csvkit_tool.py
  Use parameterized queries to prevent SQL injection

  Replaced the string concatenation for SQL queries with parameterized queries to prevent SQL injection risks.

• File changed: patchwork/common/utils/step_typing.py
  Add whitelist for trusted modules in importlib.import_module usage

  The code now includes a whitelist of trusted module paths, ensuring that only modules from this list can be imported, preventing potential execution of untrusted code.

• File changed: patchwork/app.py
  Implement whitelist for module imports to prevent arbitrary code execution.

  Introduced a whitelist to validate and allow only trusted module names for dynamic imports using importlib.import_module() to mitigate the vulnerability of loading arbitrary code.

• File changed: patchwork/common/tools/bash_tool.py
  Remove use of shell=True in subprocess.run for BashTool.

  The subprocess.run call was modified to remove shell=True for the execution of bash commands. The command is now split into a list to safely pass arguments without using a shell.

• File changed: patchwork/steps/CallShell/CallShell.py
  Fix subprocess.run vulnerability by removing shell=True

  Replaced shell=True with shell=False in subprocess.run and used shlex.split to safely handle command arguments.

• File changed: patchwork/common/utils/dependency.py
  Implement whitelist for importlib.import_module() to prevent arbitrary code execution.

  The import process now checks against a predefined list of allowed modules, effectively whitelisting them and preventing the import of arbitrary modules.