From 27311984acb079acc2fe9e48666a42ce308b533b Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
<66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 12:07:48 +0000
Subject: [PATCH] [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---
.../inference/sandbox_site/sitecustomize.py | 25 ++++++++-----------
studio/backend/core/inference/tools.py | 19 +++++---------
.../backend/tests/test_bypass_permissions.py | 2 +-
studio/backend/tests/test_permission_mode.py | 5 +---
4 files changed, 18 insertions(+), 33 deletions(-)
diff --git a/studio/backend/core/inference/sandbox_site/sitecustomize.py b/studio/backend/core/inference/sandbox_site/sitecustomize.py
index b0cae85935..3b6e2aaee7 100644
--- a/studio/backend/core/inference/sandbox_site/sitecustomize.py
+++ b/studio/backend/core/inference/sandbox_site/sitecustomize.py
@@ -380,6 +380,7 @@ def _guarded_import_module(name, package = None):
_guard_loaded_httpcore_modules()
return module
+
def _guard_legacy_source_loader():
cls = importlib.machinery.SourceFileLoader
original = getattr(cls, "load_module", None)
@@ -450,12 +451,8 @@ def _make_network_guard_audit():
origin_relative = relpath(origin_path, root).replace("\\", "/")
code_relative = relpath(code_path, root).replace("\\", "/")
return (
- (
- origin_relative == package
- or origin_relative.startswith(f"{package}/")
- )
- and (code_relative == package or code_relative.startswith(f"{package}/"))
- )
+ origin_relative == package or origin_relative.startswith(f"{package}/")
+ ) and (code_relative == package or code_relative.startswith(f"{package}/"))
except (OSError, ValueError):
return False
return False
@@ -483,9 +480,7 @@ def _make_network_guard_audit():
):
frame = frame.f_back
continue
- return not (
- frame_uses_package(frame, "httpx") or frame_uses_package(frame, "httpcore")
- )
+ return not (frame_uses_package(frame, "httpx") or frame_uses_package(frame, "httpcore"))
return True
def audit(event, args):
@@ -494,18 +489,18 @@ def _make_network_guard_audit():
if not isinstance(fullname, str):
return
root = fullname.split(".", 1)[0]
- if root in blocked or (
- root in direct_blocked and sandbox_requested_import(2)
- ):
+ if root in blocked or (root in direct_blocked and sandbox_requested_import(2)):
blocked_error(root)
return
if event not in {"socket.connect", "socket.connect_ex", "socket.getaddrinfo"}:
return
if httpcore_network_active():
return
- if package_in_stack("httpcore", 2) or package_in_stack(
- "anyio", 2
- ) or package_in_stack("trio", 2):
+ if (
+ package_in_stack("httpcore", 2)
+ or package_in_stack("anyio", 2)
+ or package_in_stack("trio", 2)
+ ):
blocked_error("httpcore")
return audit
diff --git a/studio/backend/core/inference/tools.py b/studio/backend/core/inference/tools.py
index e05d448491..26c6600612 100644
--- a/studio/backend/core/inference/tools.py
+++ b/studio/backend/core/inference/tools.py
@@ -492,18 +492,13 @@ def _python_payload_launches_startup_bypass(code: str, depth: int) -> bool:
if command_node is None:
continue
nested = _static_python_command_argument(command_node)
- if nested is not None and _sandbox_python_startup_bypasses_guard(
- nested, depth + 1
- ):
+ if nested is not None and _sandbox_python_startup_bypasses_guard(nested, depth + 1):
return True
return False
def _segment_python_launch_bypasses_guard(
- segment: list[str],
- python_index: int,
- environment_tainted: bool,
- depth: int,
+ segment: list[str], python_index: int, environment_tainted: bool, depth: int
) -> bool:
if environment_tainted or _segment_mutates_sandbox_python_env(segment, python_index):
return True
@@ -3229,7 +3224,9 @@ def _render_html_computed_network_access(code: str, depth: int = 0) -> bool:
arguments = _js_call_arguments(code, match.end())
if arguments is None:
return True
- method = (match.group("insert") or match.group("contextual") or match.group("write")).lower()
+ method = (
+ match.group("insert") or match.group("contextual") or match.group("write")
+ ).lower()
if _render_html_markup_call_reaches_network(arguments, method, depth):
return True
@@ -6186,11 +6183,7 @@ def _check_signal_escape_patterns(code: str):
def _source_loader_module_name(self, node) -> str | None:
if isinstance(node, ast.Name):
return self.source_loader_names.get(node.id)
- if (
- isinstance(node, ast.Call)
- and self._is_source_file_loader(node.func)
- and node.args
- ):
+ if isinstance(node, ast.Call) and self._is_source_file_loader(node.func) and node.args:
return self._static_string(node.args[0])
return None
diff --git a/studio/backend/tests/test_bypass_permissions.py b/studio/backend/tests/test_bypass_permissions.py
index 621cde9292..79f5957bec 100644
--- a/studio/backend/tests/test_bypass_permissions.py
+++ b/studio/backend/tests/test_bypass_permissions.py
@@ -187,7 +187,7 @@ def test_bash_blocklist_enforced_when_sandboxed(captured_popen):
'find . -type f -execdir bash -c "python -I -c import\\ boto3" ;',
'python$IFS-S -c "import boto3"',
"python -c \"import subprocess; subprocess.run(['python','-S','-c','import boto3'])\"",
- "python -c \"import os; os.system(\\\"python -S -c 'import boto3'\\\")\"",
+ 'python -c "import os; os.system(\\"python -S -c \'import boto3\'\\")"',
],
)
def test_bash_blocks_python_startup_guard_bypasses(captured_popen, command):
diff --git a/studio/backend/tests/test_permission_mode.py b/studio/backend/tests/test_permission_mode.py
index e884cbb4ab..cde473561e 100644
--- a/studio/backend/tests/test_permission_mode.py
+++ b/studio/backend/tests/test_permission_mode.py
@@ -1131,10 +1131,7 @@ def test_render_html_gated_only_when_networked():
is True
)
assert (
- rh(
- ""
- )
+ rh("")
is False
)
assert rh("") is True