| User direct input (graph state, config) |
DF8 |
— |
Graph structure validation
(libs/langgraph/langgraph/pregel/_validate.py:validate_graph),
channel type enforcement
(libs/langgraph/langgraph/channels/base.py:BaseChannel),
sensitive key filtering
(libs/langgraph/langgraph/_internal/_config.py:_exclude_as_metadata) |
User |
Node implementation safety is user’s responsibility |
| LLM output (tool calls) |
DF3, DF4, DF14 |
— |
Tool name allowlist
(libs/prebuilt/langgraph/prebuilt/tool_node.py:ToolNode._validate_tool_call),
tool Pydantic schemas, injection merge order
(libs/prebuilt/langgraph/prebuilt/tool_node.py:ToolNode._inject_tool_args),
tool_call_schema filtering of injected params |
Shared (project validates name and injection safety; user validates
args via tool schema) |
No ToolNode-level argument sanitization beyond injection
overwrite |
| Checkpoint storage data |
DF1, DF2, DF11 |
T1, T2, T3, T10 |
Msgpack allowlist
(libs/checkpoint/langgraph/checkpoint/serde/_msgpack.py:SAFE_MSGPACK_TYPES
— 47 entries), msgpack method allowlist
(libs/checkpoint/langgraph/checkpoint/serde/_msgpack.py:SAFE_MSGPACK_METHODS),
JSON allowlist
(libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py:_check_allowed_json_modules),
pickle gating, serde event hooks, optional encryption |
Shared (project owns serializer defaults; user owns DB access
controls) |
Default msgpack mode allows unregistered types; EncryptedSerializer
accepts unencrypted data; proposed secure_pickle.py never merged |
| Remote API responses |
DF5, DF9, DF12, DF13 |
T4, T9 |
Outbound config sanitization
(libs/langgraph/langgraph/pregel/remote.py:_sanitize_config);
no inbound validation; no redirect URL validation |
User (user chooses which server to trust) |
No inbound schema validation; API key forwarded on redirects |
| Configuration (langgraph.json) |
DF6, DF7 |
T5 |
JSON schema validation
(libs/cli/langgraph_cli/config.py:validate_config_file),
build command content validation
(libs/cli/langgraph_cli/config.py:has_disallowed_build_command_content),
list-based subprocess args, WebhookUrlPolicy
(libs/cli/langgraph_cli/schemas.py:WebhookUrlPolicy) |
User (developer-controlled file) |
Single-quote not escaped in ENV embedding |
| Configuration (env vars) |
DF10 |
T7, T8 |
AES key length validation, EAX MAC verification |
User (deployer controls env) |
Key entropy, assert-based check |
| Developer encryption handlers |
DF15 |
— |
Handler signature validation
(libs/sdk-py/langgraph_sdk/encryption/__init__.py:_validate_handler),
duplicate prevention |
User (developer-authored code) |
context() handler missing
_validate_handler call |