ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[pre-commit.ci] auto fixes from pre-commit.com hooks

Browse source 
for more information, see https://pre-commit.ci
This commit is contained in:
pre-commit-ci[bot] 2026-07-20 13:19:35 +00:00
commit d9ba4e7d05
2 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
studio/backend/core/inference/tools.py
View file

@ -767,9 +767,7 @@ def _sandbox_python_startup_bypasses_guard(
if _python_inline_payload(arguments) is None and _python_reads_program_from_stdin(
arguments
):
if _python_payload_launches_startup_bypass(
payload, depth + 1, environment_tainted
):
if _python_payload_launches_startup_bypass(payload, depth + 1, environment_tainted):
return True
# Preserve the previous fail-safe for nested shell bodies.
if _sandbox_python_startup_bypasses_guard(payload, depth + 1, environment_tainted):

12
studio/backend/tests/test_permission_mode.py
View file

@ -954,7 +954,9 @@ def test_python_classifier(code, unsafe):
def test_python_runtime_safety_blocks_child_startup_guard_bypass():
from core.inference.tools import _check_code_safety
assert _check_code_safety("import subprocess\nsubprocess.run(['python','-c','print(1)'])") is None
assert (
_check_code_safety("import subprocess\nsubprocess.run(['python','-c','print(1)'])") is None
)
assert (
_check_code_safety(
"import os, subprocess\n"
@ -1133,7 +1135,9 @@ def test_render_html_gated_only_when_networked():
assert rh("<script>Object.assign(new Image(), {['src']: './local.png'})</script>") is False
assert rh("<script>Object.assign(new Image(), {[key]: 'https://evil/x'})</script>") is True
assert (
rh("<script>const key='title'; Object.assign(new Image(), {[key]: 'https://evil/x'})</script>")
rh(
"<script>const key='title'; Object.assign(new Image(), {[key]: 'https://evil/x'})</script>"
)
is False
)
assert rh("<script>img['src']='./local.png'</script>") is False
@ -1149,7 +1153,9 @@ def test_render_html_gated_only_when_networked():
assert rh("<script>document.write.call(document, '<img src=https://evil/x>')</script>") is True
assert rh("<script>document.write.call(document, '<p>Local</p>')</script>") is False
assert (
rh("<script>node.insertAdjacentHTML.apply(node, ['beforeend', '<img src=https://evil/x>'])</script>")
rh(
"<script>node.insertAdjacentHTML.apply(node, ['beforeend', '<img src=https://evil/x>'])</script>"
)
is True
)
assert (