[rajarshidattapy] fix(outputs): close sandbox escape in backend-code executor (#134)#137
Open
rajarshidattapy wants to merge 1 commit into
Conversation
…m-ai#134) The AST allowlist never saw `sys.modules["os"]`: the subprocess preamble scrubs builtins but leaves sys/sys.modules live, so user code retrieved the already-loaded os module with no import statement and no blocked-builtin call (same for the ().__class__.__subclasses__() / __globals__ object walk). And /api/outputs/execute ran empty-warning code with force_env, inheriting PATH/COMSPEC so os.system was reachable with no consent. - executor: block bare names sys/__import__/__builtins__, all dunder attribute access, and dynamic-attr builtins (getattr/setattr/vars/...), so user code can't reach a withheld module. - executor: split force_env from skip_validation; the privileged inherit-real-env mode is now an explicit, separate decision. - outputs: gate force_env on body.force alone, so vetted-but-unforced code stays in the minimal env. - add tests/test_outputs_executor_sandbox.py regression suite. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
rajarshidattapy
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #134.
The Output backend-code sandbox was bypassable because the AST allowlist did not detect access to
sys.modules["os"]. The subprocess preamble removed dangerous builtins but leftsysandsys.modulesintact, allowing backend code to retrieve the already-loadedosmodule without using animportstatement or any blocked builtin. The same bypass applied to object-graph traversal techniques such as().__class__.__subclasses__()and__globals__(). Additionally,/api/outputs/executeexecuted validated-but-unforced code in the privileged environment, makingos.system()reachable without explicit user consent.Changes
sys__import____builtins__getattr,setattr,delattr,vars, and related primitivesforce_envfromskip_validation, ensuring that the privileged environment (PATH/COMSPEC) is used only when the request explicitly specifiesforce=true.tests/test_outputs_executor_sandbox.py.Validation