Close seven static-classifier bypasses in studio/backend/core/inference/tools.py:
- Home-rooted PATH: in the sandbox HOME and the child cwd ARE the session
workdir, so a ~ / ~user or $HOME / $PWD (${HOME} / ${PWD}) PATH entry lets a
bare command resolve to a workdir shebang. _path_value_is_unsafe now flags
those while keeping absolute, $PATH, and other $VAR (assumed absolute) entries
allowed, so PATH=~/bin evil / env={'PATH': '~/bin'} block.
- git write targets: git is a native child the runtime backstop cannot see, so
git init /tmp/x, git clone url /tmp/x, git init ../x, and git -C /outside /
--git-dir= / --work-tree= / --separate-git-dir= write outside the workdir.
Flag a git path operand or dir-option value that escapes the workdir; all
workdir-relative git usage (status, log, clone url, -C sub) stays allowed.
- args= shell child: the argv sequence can be passed through the public args=
keyword, which left _is_shell_child false and accepted a BASH_ENV / opaque env
for a bash child. Resolve the argv from node.args[0] OR the args= kwarg for
both the executable= reconstruction and the shell-child env check.
- posix_spawn: os.posix_spawn(path, argv, env) executes path while argv[0] is
cosmetic, but it never entered the exec/spawn argv reconstruction, so a
literal-env form (env=() / a byte list) ran a mutating tail (sed -i /tmp/out)
unguarded. Widen the reconstruction to os.posix_spawn / os.posix_spawnp.
- Python launcher scripts: pip / pytest / ipython console scripts start a fresh
unguarded interpreter (the same escape as the already-blocked bare python), so
subprocess.run(['pytest', 'evil.py']) / pip install <local sdist> could run
workdir code. Deny the well-known launcher entry points.
- Command-name globs: /bin/s? / touc? / /bin/[bd]ash expand to a shell / writer
before command lookup while the scanner compares the literal basename. Fail
closed on * / ? / [ ] glob metacharacters in a command word (a bare [ is the
test builtin and stays allowed).
- Pickle-backed loaders: torch.load(weights_only=False), joblib.load, and
numpy.load(allow_pickle=True) run a reduce payload. Flag the unsafe forms
while the safe defaults (torch.load(f), torch.load(f, weights_only=True),
numpy.load(f)) stay allowed.
Regression coverage: TestRound35Bypasses in tests/test_sandbox_tools.py.
3bad13b58d