fix: sandbox LLM-generated code execution to prevent RCE (#1893, #1895) - #1899
Open
benaiah-muga wants to merge 1 commit into
Open
fix: sandbox LLM-generated code execution to prevent RCE (#1893, #1895)#1899benaiah-muga wants to merge 1 commit into
benaiah-muga wants to merge 1 commit into
Conversation
- Add restricted __builtins__ with safe __import__ wrapper in environment.py that blocks dangerous builtins (open, exec, eval, compile, getattr, etc.) while allowing safe data analysis operations - Add AST-level _SecurityVisitor in code_validation.py that detects and blocks imports of dangerous modules (os, subprocess, sys, etc.), __import__() calls, and attribute access on dangerous modules before code reaches exec() - Defense in depth: AST validation catches malicious code at generation time, restricted builtins catch any bypass at execution time - Fixes sinaptik-ai#1893 (Code Injection in CodeExecutor.execute) - Fixes sinaptik-ai#1895 (Default code executor runs with full builtins, no sandbox)
dosubot
Bot
added
the
size:L
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1893 (Code Injection in
CodeExecutor.execute) and #1895 (Default code executor runs with full builtins, no sandbox).Both issues share the same root cause: LLM-generated code is executed via
exec()with full Python builtins, allowingimport os; os.system(...)to run arbitrary OS commands. This PR adds defense in depth at two layers.Changes
Layer 1: AST-level validation (
code_validation.py)_SecurityVisitorthat detects and blocks:import os,import subprocess, etc. (70+ dangerous modules)from os import system,from subprocess import Popen, etc.__import__("os")callsos.system(...),subprocess.Popen(...)attribute accessMaliciousCodeGeneratedexceptionLayer 2: Restricted builtins (
environment.py)_safe_import()wrapper that blocks dangerous module imports at runtime_get_restricted_builtins()that removesopen,exec,eval,compile,getattr,setattr,delattr, etc.len,range,print, exceptions, etc.) preservedTests
Verification
PoC from #1893:
import os; os.system("whoami")-> BLOCKED (CodeExecutionError)PoC from #1895:
import os; os.popen("whoami").read()-> BLOCKED (CodeExecutionError)Legitimate code:
result = len(pd.DataFrame({"a": [1,2,3]}))-> WORKS