fix(docling): preserve metadata and harden Astra/read-file paths

Author: andifilhohub

src/backend/tests/unit/components/files_and_knowledge/test_file_component.py

@@ -143,6 +143,30 @@ def test_process_docling_subprocess_success(self, mock_subprocess):
         assert result.data["doc"] == mock_result["doc"]
         assert result.data["file_path"] == "test.pdf"
 
+    @patch("subprocess.run")
+    def test_process_docling_subprocess_allows_ampersand_in_path(self, mock_subprocess):
+        """Test that valid file paths containing '&' are not rejected before subprocess execution."""
+        component = FileComponent()
+        component.markdown = False
+
+        mock_result = {
+            "ok": True,
+            "mode": "structured",
+            "doc": [{"page_no": 1, "label": "paragraph", "text": "Content", "level": 0}],
+            "meta": {"file_path": "/tmp/input.pdf"},
+        }
+        mock_subprocess.return_value = MagicMock(
+            stdout=json.dumps(mock_result).encode("utf-8"),
+            stderr=b"",
+        )
+
+        input_path = "docs/R&D/report.pdf"
+        result = component._process_docling_in_subprocess(input_path)
+
+        assert "error" not in result.data
+        assert result.data["file_path"] == input_path
+        mock_subprocess.assert_called_once()
+
     def test_dynamic_outputs_have_tool_mode_enabled(self):
         """Test that all dynamically created outputs have tool_mode=True."""
         component = FileComponent()

src/lfx/src/lfx/base/data/docling_utils.py

@@ -34,10 +34,31 @@ def extract_docling_documents(
     Returns:
         A tuple of (documents, warning_message) where warning_message is None if no warning
 
+    Raises:
+        TypeError: If the data cannot be extracted or is invalid
+    """
+    documents, _, warning_message = extract_docling_documents_with_metadata(data_inputs, doc_key)
+    return documents, warning_message
+
+
+def extract_docling_documents_with_metadata(
+    data_inputs: Data | list[Data] | DataFrame, doc_key: str
+) -> tuple[list[DoclingDocument], list[dict], str | None]:
+    """Extract DoclingDocument objects and aligned metadata from data inputs.
+
+    Args:
+        data_inputs: The data inputs containing DoclingDocument objects
+        doc_key: The key/column name to look for DoclingDocument objects
+
+    Returns:
+        A tuple of (documents, metadata, warning_message) where warning_message is None if no warning.
+        Metadata entries preserve all source fields except the DoclingDocument field itself.
+
     Raises:
         TypeError: If the data cannot be extracted or is invalid
     """
     documents: list[DoclingDocument] = []
+    metadata: list[dict] = []
     warning_message: str | None = None
 
     if isinstance(data_inputs, DataFrame):
@@ -46,6 +67,7 @@ def extract_docling_documents(
             raise TypeError(msg)
 
         # Primary: Check for exact column name match
+        source_column = doc_key
         if doc_key in data_inputs.columns:
             try:
                 documents = data_inputs[doc_key].tolist()
@@ -73,6 +95,7 @@ def extract_docling_documents(
                 logger.warning(warning_message)
                 try:
                     documents = data_inputs[found_column].tolist()
+                    source_column = found_column
                 except Exception as e:
                     msg = f"Error extracting DoclingDocument from DataFrame column '{found_column}': {e}"
                     raise TypeError(msg) from e
@@ -88,36 +111,45 @@ def extract_docling_documents(
                     f"3. If using VLM pipeline, try using the standard pipeline"
                 )
                 raise TypeError(msg)
+
+        for row in data_inputs.to_dict(orient="records"):
+            row_doc = row.get(source_column)
+            if isinstance(row_doc, DoclingDocument):
+                metadata.append({k: v for k, v in row.items() if k != source_column})
     else:
         if not data_inputs:
             msg = "No data inputs provided"
             raise TypeError(msg)
 
         if isinstance(data_inputs, Data):
-            if doc_key not in data_inputs.data:
+            if doc_key not in data_inputs.data or not isinstance(data_inputs.data[doc_key], DoclingDocument):
                 msg = (
                     f"'{doc_key}' field not available in the input Data. "
                     "Check that your input is a DoclingDocument. "
                     "You can use the Docling component to convert your input to a DoclingDocument."
                 )
                 raise TypeError(msg)
             documents = [data_inputs.data[doc_key]]
+            metadata = [{k: v for k, v in data_inputs.data.items() if k != doc_key}]
         else:
             try:
-                documents = [
-                    input_.data[doc_key]
-                    for input_ in data_inputs
-                    if isinstance(input_, Data)
-                    and doc_key in input_.data
-                    and isinstance(input_.data[doc_key], DoclingDocument)
-                ]
+                documents = []
+                metadata = []
+                for input_ in data_inputs:
+                    if (
+                        isinstance(input_, Data)
+                        and doc_key in input_.data
+                        and isinstance(input_.data[doc_key], DoclingDocument)
+                    ):
+                        documents.append(input_.data[doc_key])
+                        metadata.append({k: v for k, v in input_.data.items() if k != doc_key})
                 if not documents:
                     msg = f"No valid Data inputs found in {type(data_inputs)}"
                     raise TypeError(msg)
             except AttributeError as e:
                 msg = f"Invalid input type in collection: {e}"
                 raise TypeError(msg) from e
-    return documents, warning_message
+    return documents, metadata, warning_message
 
 
 def _unwrap_secrets(obj):

src/lfx/src/lfx/components/datastax/astradb_vectorstore.py

@@ -1,3 +1,5 @@
+import math
+
 from astrapy import DataAPIClient
 from langchain_core.documents import Document
 
@@ -409,7 +411,11 @@ def _add_documents_to_vector_store(self, vector_store) -> None:
                 raise TypeError(msg)
 
         documents = [
-            Document(page_content=doc.page_content, metadata=serialize(doc.metadata, to_str=True)) for doc in documents
+            Document(
+                page_content=doc.page_content,
+                metadata=serialize(self._sanitize_metadata(doc.metadata), to_str=True),
+            )
+            for doc in documents
         ]
 
         if documents and self.deletion_field:
@@ -434,6 +440,18 @@ def _add_documents_to_vector_store(self, vector_store) -> None:
         else:
             self.log("No documents to add to the Vector Store.")
 
+    @classmethod
+    def _sanitize_metadata(cls, value):
+        if isinstance(value, float) and not math.isfinite(value):
+            return None
+        if isinstance(value, dict):
+            return {k: cls._sanitize_metadata(v) for k, v in value.items()}
+        if isinstance(value, list):
+            return [cls._sanitize_metadata(v) for v in value]
+        if isinstance(value, tuple):
+            return tuple(cls._sanitize_metadata(v) for v in value)
+        return value
+
     def _map_search_type(self) -> str:
         search_type_mapping = {
             "Similarity with score threshold": "similarity_score_threshold",

src/lfx/src/lfx/components/docling/export_docling_document.py

@@ -2,7 +2,7 @@
 
 from docling_core.types.doc import ImageRefMode
 
-from lfx.base.data.docling_utils import extract_docling_documents
+from lfx.base.data.docling_utils import extract_docling_documents_with_metadata
 from lfx.custom import Component
 from lfx.io import DropdownInput, HandleInput, MessageTextInput, Output, StrInput
 from lfx.schema import Data, DataFrame
@@ -86,14 +86,14 @@ def update_build_config(self, build_config: dict, field_value: Any, field_name:
         return build_config
 
     def export_document(self) -> list[Data]:
-        documents, warning = extract_docling_documents(self.data_inputs, self.doc_key)
+        documents, metadata_list, warning = extract_docling_documents_with_metadata(self.data_inputs, self.doc_key)
         if warning:
             self.status = warning
 
         results: list[Data] = []
         try:
             image_mode = ImageRefMode(self.image_mode)
-            for doc in documents:
+            for index, doc in enumerate(documents):
                 content = ""
                 if self.export_format == "Markdown":
                     content = doc.export_to_markdown(
@@ -108,7 +108,8 @@ def export_document(self) -> list[Data]:
                 elif self.export_format == "DocTags":
                     content = doc.export_to_doctags()
 
-                results.append(Data(text=content))
+                metadata = metadata_list[index] if index < len(metadata_list) else {}
+                results.append(Data(text=content, data=metadata))
         except Exception as e:
             msg = f"Error splitting text: {e}"
             raise TypeError(msg) from e

src/lfx/src/lfx/components/files_and_knowledge/file.py

@@ -1000,8 +1000,8 @@ def main():
             """
         )
 
-        # Validate file_path to avoid command injection or unsafe input
-        if not isinstance(args["file_path"], str) or any(c in args["file_path"] for c in [";", "|", "&", "$", "`"]):
+        # Input goes through stdin (not shell); reject only clearly invalid path payloads.
+        if not isinstance(args["file_path"], str) or not args["file_path"] or "\x00" in args["file_path"]:
             return Data(data={"error": "Unsafe file path detected.", "file_path": args["file_path"]})
 
         proc = subprocess.run(  # noqa: S603

src/lfx/tests/unit/components/datastax/test_astradb_vectorstore_component.py

@@ -0,0 +1,18 @@
+from lfx.components.datastax.astradb_vectorstore import AstraDBVectorStoreComponent
+
+
+class TestAstraDBVectorStoreComponent:
+    def test_sanitize_metadata_replaces_non_finite_floats(self):
+        metadata = {
+            "score": float("nan"),
+            "nested": {"upper": float("inf"), "lower": float("-inf")},
+            "items": [1.0, float("nan"), {"v": float("inf")}],
+        }
+
+        sanitized = AstraDBVectorStoreComponent._sanitize_metadata(metadata)
+
+        assert sanitized["score"] is None
+        assert sanitized["nested"]["upper"] is None
+        assert sanitized["nested"]["lower"] is None
+        assert sanitized["items"][1] is None
+        assert sanitized["items"][2]["v"] is None

src/lfx/tests/unit/components/docling/test_export_docling_document_component.py

@@ -0,0 +1,34 @@
+import pytest
+
+pytest.importorskip("docling_core")
+
+from lfx.components.docling.export_docling_document import ExportDoclingDocumentComponent
+
+
+class _DummyDoc:
+    def export_to_markdown(self, **_kwargs):
+        return "exported markdown"
+
+
+class TestExportDoclingDocumentComponent:
+    def test_export_document_preserves_input_metadata(self, monkeypatch):
+        component = ExportDoclingDocumentComponent()
+        component.export_format = "Markdown"
+        component.image_mode = "placeholder"
+        component.md_image_placeholder = "<!-- image -->"
+        component.md_page_break_placeholder = ""
+        component.doc_key = "doc"
+
+        metadata = {"file_path": "docs/report.pdf", "source": "docling-remote"}
+        monkeypatch.setattr(
+            "lfx.components.docling.export_docling_document.extract_docling_documents_with_metadata",
+            lambda *_args, **_kwargs: ([_DummyDoc()], [metadata], None),
+        )
+
+        result = component.export_document()
+
+        assert len(result) == 1
+        assert result[0].text == "exported markdown"
+        assert result[0].data["file_path"] == "docs/report.pdf"
+        assert result[0].data["source"] == "docling-remote"
+        assert "doc" not in result[0].data