Documentation

Converters reference

This page is generated from the converter plugins in the ASH source code by scripts/generate_converter_reference.py. Edits made to this file by hand are overwritten the next time it is generated.

ASH ships 2 converters. Converters run in the convert phase, before the scan phase, and write what they produce under <output directory>/converted/<converter name>/.

Converter	Enabled by default	Provided by	Command	Runs with --python-only
archive	yes	built in	none (runs in the ASH process)	yes
jupyter	yes	built in	jupyter-nbconvert	yes

archive

Converter implementation for Archive file extraction.

• Class: automated_security_helper.plugin_modules.ash_builtin.converters.archive_converter.ArchiveConverter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• Command: none (runs in the ASH process)
• Install: none declared

Options, under converters.archive.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
max_members	integer, greater than 0	100000	The most members an archive may have, directories included. An archive with more is not extracted. All the archives one scan extracts may hold four times this many together.
max_member_bytes	integer, greater than 0	268435456	The largest size in bytes one member of an archive may declare. An archive with a larger member is not extracted. Default 256 MiB.
max_total_bytes	integer, greater than 0	1073741824	The most bytes an archive's members may declare added up, each counted as at least 512. An archive whose members declare more is not extracted. All the archives one scan extracts may declare four times this together. Default 1 GiB.
max_compression_ratio	integer, greater than 0	100	The most times its own size on disk that an archive's members may declare added up. An archive that declares more is not extracted. Checked only once the members declare more than 512 KiB in all.

jupyter

Converter implementation for Jupyter notebooks security scanning.

• Class: automated_security_helper.plugin_modules.ash_builtin.converters.jupyter_converter.JupyterConverter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• Command: jupyter-nbconvert
• Install: uv tool install on first use (nbconvert>=7.16.0,<8.0.0)

Options, under converters.jupyter.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
tool_version	string or null	">=7.16.0,<8.0.0"	Version constraint for nbconvert tool installation (e.g., '>=7.16.0'). If not specified, the latest version will be installed.
install_timeout	integer	300	Timeout in seconds for tool installation (default: 300)