Close six P1 bypasses Codex found on the round-41 branch:
- compile(source=...) keyword payload: compile() accepts its source as the source=
keyword, but the analyzer only recovered the 1st positional arg, so a keyword-only
compile feeding types.FunctionType(code)() (or exec(compile(source=...))) was treated
as having no payload and ran unscanned. Recover the source= keyword too (new
_compile_source_node), at both the code-object tracking and exec(compile()) sites.
The remaining five harden the workdir-module import vetter (a helper .py the user
wrote is vetted before import; each of these slipped a payload past it):
- PEP 263 source encoding: the vetter read modules as fixed UTF-8, but Python's loader
honors an encoding cookie. A `# coding: utf_7` module hides os.system in what the
UTF-8 scan sees as a comment (raw +AAo- bytes are a newline under UTF-7). Decode with
importlib.util.decode_source so the vetter sees what the loader will run.
- bytecode cache: after scanning the source, returning the original spec let
SourceFileLoader satisfy the import from a planted __pycache__ .pyc whose header
matches the harmless source. Run the EXACT vetted source via a dedicated loader
(_GuardVettedSourceLoader) so the bytecode cache is never consulted.
- symlinked module: a workdir module that is a symlink to an outside file had a realpath
outside the workdir, so it was treated as not-workdir and handed to the default loader
unvetted. Decide workdir-membership by the origin path, then fail closed when the
realpath escapes.
- network sinks: the vetter only checked command-exec/eval, so a helper doing
socket.create_connection(...) bypassed the static network policy (no runtime network
backstop). Refuse a workdir module that imports a network primitive (socket / ssl /
ftplib / smtplib / requests / httpx / aiohttp / ...).
- os import aliases: sink references were only recognized when rooted at literal os /
posix, so import os as o; s = o.system; s(...) passed (the assignment, not a direct
call). Record os / posix import aliases before checking sink references.
Regression coverage: TestRound42Bypasses in tests/test_sandbox_tools.py (compile
source= keyword, positional, and exec(compile()) forms) and five workdir-module vetter
tests in tests/test_sandbox_runtime_backstop.py (utf-7 encoding denied, forged pyc
ignored while the vetted source runs, symlinked module denied, network sink denied, os
import alias denied).
f11fbdcb7f