fix(security): 2 improvements across 2 files

[SlncTrZ]

Summary

fix(security): 2 improvements across 2 files

Problem

Severity: Low | File: setup.py:L11

The setup.py script uses exec(line, g) to evaluate a line from sonnet/__init__.py that defines __version__. This is dangerous because it executes arbitrary Python code from the file. While the file is trusted in normal circumstances, a compromised or maliciously modified __init__.py could execute arbitrary code during the package installation process. The proper approach is to parse the version string without exec (e.g., using regular expressions or ast.literal_eval on a well-formed assignment).

Solution

Replace exec(line, g) with a safe parsing method, such as match = re.search(r"__version__\s*=\s*['\"]([^'\"]+)['\"]", line); version = match.group(1) to extract the version string without executing code.

Changes

• setup.py (modified)
• sonnet/src/nets/dnc/read.py (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced"

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.