Close eight gaps Codex found on the round-60 branch (seven inline P1 plus one
review-body P1). Five are in the runtime workdir-module import vetter (a planted
workdir helper is not scanned by the outer static pass), two are in the static
network scanner, and one is the runtime sqlite URI parser.
- assigned os aliases in the vetter: the pre-pass only recorded `import os as o`
aliases, so a workdir helper doing `import os; o = os; o.system(...)` passed
vetting and spawned an unguarded child. Follow simple whole-module assignments
(o = os; b = builtins; s = sys) to a fixpoint before the sink checks.
- module namespace-dict subscripts in the vetter: `os.__dict__['system'](...)`
reached the sink because __dict__ was not a gadget and the subscript branch only
failed closed for builtins. Fail closed on a `<module>.__dict__[...]` subscript
for os / posix / deserializer / sys / importlib, like vars(<module>).
- module __getattribute__ / __getattr__ in the vetter: `os.__getattribute__(
'system')(...)` reached the sink because only the builtin getattr(...) form was
recognized. Classify bound `module.__getattribute__('name')` and unbound
`object.__getattribute__(module, 'name')` lookups the same way as getattr.
- MRO base recovery in the vetter: `io.FileIO.__mro__[1]('/tmp/x','w')` /
`sqlite3.Connection.__mro__[1](...)` recovered an unguarded base class because the
helper gadget set omitted __mro__ / mro. Add both to the gadget attributes.
- sys.modules in the vetter: `sys.modules['os'].system(...)` recovered the
guard-cached os module without an import, bypassing the denied-import path. Deny
sys.modules access (direct attribute and getattr form) in a vetted workdir module.
- public network client entry points: `requests.api.get(...)`, `ftplib.FTP(...)`,
and `smtplib.SMTP(...)` were not in the network prefix table, so a metadata /
untrusted host reached through them bypassed the allowlist. Add requests.api.*,
ftplib.FTP / FTP_TLS, and smtplib.SMTP / SMTP_SSL / LMTP (the ftplib / smtplib
clients take a bare host), and track ftplib / smtplib import aliases.
- request(method, url) URL argument: module-level requests.request / httpx.request /
urllib3.request (and requests.api.request) carry the URL at arg1, but the code
passed arg0 (the HTTP method) to the host check, so the URL was never inspected.
Read the URL from arg1 for these method-first APIs, like the client-instance
.request() branch.
- sqlite URI mode=memory parsing: a `file:/tmp/escape.db?xmode=memory` URI was
treated as in-memory by a substring test and skipped path confinement, but SQLite
ignores the unknown xmode key and opens the on-disk file. Parse the query exactly
(split on &, first occurrence of a repeated key, percent-decoded) and treat only a
genuine mode=memory parameter as in-memory, in the runtime guard and the two static
sqlite operand checks.
Regression coverage: TestRound61Bypasses in tests/test_sandbox_tools.py (request()
URL at arg1 for requests / httpx / urllib3 / requests.api, network client entry
points against metadata and untrusted hosts, sqlite shell xmode=memory on an
escaping absolute path, plus a benign-allowed set: trusted-host requests / api /
ftplib / smtplib, a genuine in-memory URI, and a workdir-relative db) and, in
tests/test_sandbox_runtime_backstop.py, workdir-module denials for the assigned os
alias, os.__dict__ subscript, os.__getattribute__, io.FileIO.__mro__, and
sys.modules['os'] forms, a benign os-alias helper that still imports, and the sqlite
URI xmode=memory escape denial plus a genuine mode=memory allowance.
236e89d0c9