Patched code sample

import importlib
from typing import Any, Dict, Type

def _is_allowed_module(module_path: str) -> bool:
    """Checks if a module is in an allow-list of safe-to-load modules."""
    # A real implementation would have a carefully curated list.
    return module_path.startswith("kotaemon.")

def _import_class(class_path: str) -> Type[Any]:
    """Dynamically import a class from its full path."""
    module_path, class_name = class_path.rsplit(".", 1)
    module = importlib.import_module(module_path)
    return getattr(module, class_name)

class Serializable:
    """
    Base class for components in kotaemon that can be deserialized from a dict.
    This logic is triggered by endpoints like /check_connection from user JSON.
    """
    def __init__(self, **kwargs):
        pass

    @classmethod
    def from_dict(cls, data: Dict[str, Any]) -> "Serializable":
        """Deserialize a component based on the '__type__' field in the data."""
        if "__type__" not in data:
            raise ValueError("Deserialization data must contain a '__type__' field.")

        class_name = data.pop("__type__")
        
        module_path, _ = class_name.rsplit(".", 1)
        # FIX: Validate the module path against an allow-list before importing.
        if not _is_allowed_module(module_path):
            raise ValueError(f"Module '{module_path}' is not allowed for deserialization.")
        
        component_class = _import_class(class_name)
        
        return component_class(**data)