006bf4479e
The python tool's static safety analysis (_check_signal_escape_patterns) was purely name-based with no attribute visitor, so obfuscated routes to the shell / network / file policies it already enforces slipped past: eval / exec / compile, __import__ / importlib with a computed or dangerous module name, getattr / setattr aimed at os / subprocess / sys / builtins, and dunder gadget chains (().__class__.__bases__[0].__subclasses__()). Add a dynamic_exec category covering those, surfaced through _check_code_safety alongside the existing categories. Dynamic import stays allowed for a benign literal module name (huggingface_hub, json, numpy) so real workflows and the HF upload gate keep working; ordinary getattr(obj, "field") and __class__ access stay benign. Bypass Permissions (disable_sandbox) still skips the check. Tests: TestDynamicExecObfuscation in test_sandbox_tools.py with matching benign cases, giving _check_signal_escape_patterns its first direct coverage. |
||
|---|---|---|
| .. | ||
| assets | ||
| auth | ||
| core | ||
| hub | ||
| loggers | ||
| models | ||
| plugins | ||
| requirements | ||
| routes | ||
| state | ||
| storage | ||
| tests | ||
| utils | ||
| __init__.py | ||
| _platform_compat.py | ||
| cloudflare_tunnel.py | ||
| colab.py | ||
| main.py | ||
| run.py | ||
| startup_banner.py | ||