Summary
DocuEngineHelper.validate_params() evaluates backend-provided validation expressions with Python eval(). Even if the remote payload is trusted today, this is a fragile execution path for request validation and makes local reasoning about safety much harder.
Reproduction
Inspect src/openapi_mcp_sdk/apis/docuengine.py and follow the validation branch for requestStructure.validation.
Expected
Validation logic should use a small safe parser or an explicit boolean-expression evaluator.
Actual
The current implementation builds a string expression and passes it to eval().
Suggested direction
A small parser supporting and, or, and parentheses would likely be enough for this use case.
Summary
DocuEngineHelper.validate_params()evaluates backend-provided validation expressions with Pythoneval(). Even if the remote payload is trusted today, this is a fragile execution path for request validation and makes local reasoning about safety much harder.Reproduction
Inspect
src/openapi_mcp_sdk/apis/docuengine.pyand follow the validation branch forrequestStructure.validation.Expected
Validation logic should use a small safe parser or an explicit boolean-expression evaluator.
Actual
The current implementation builds a string expression and passes it to
eval().Suggested direction
A small parser supporting
and,or, and parentheses would likely be enough for this use case.