T09 · Insecure Skill Coding Practices
Error
- Location
lib/cad_executor.py:155- Finding
Generated Python Scripts Execute in a Bypassable In-Process Sandbox
- Content
View full analysis
Vulnerability Details
File Location:
lib/cad_executor.py:155-194; supporting validation logic inlib/utils/helpers.py:124-263
Vulnerability Type: In-process execution of untrusted Python with an incomplete deny-list sandbox
Risk Level: CriticalVulnerable Code
python script_content = script.read_text(encoding='utf-8') # Validate script (STRICT - blocks on dangerous patterns) if validate: from lib.utils.helpers import CADScriptValidator is_safe, errors = CADScriptValidator.validate_strict(script_content) if not is_safe: console.print("[red]Script validation FAILED - dangerous patterns detected:[/red]") for error in errors: console.print(f" [red]✗[/red] {error}") console.print("\n[yellow]Script execution blocked for security.[/yellow]") raise typer.Exit(1) # Get backend try: backend = get_backend(platform) console.print(f"[green]Backend initialized: {backend.name}[/green]") except BackendNotAvailableError as e: console.print(f"[red]{e}[/red]") if e.hint: console.print(f"[yellow]{e.hint}[/yellow]") raise typer.Exit(1) # Prepare execution namespace (SANDBOXED) output_path = output or (Path.cwd() / f"output.{format}") output_path.parent.mkdir(parents=True, exist_ok=True) # Restricted namespace - only safe utilities safe_namespace = { 'backend': backend, 'output': output_path, 'format': format, 'Path': Path, # No console, no builtins access } # Execute script console.print(f"\n[cyan]Executing script...[/cyan]") try: exec(script_content, {"__builtins__": {}}, safe_namespace)The validator relies on regular-expression and AST deny-lists:
python def visit_Call(self, node): # Check for dangerous function calls if isinstance(node.func, ast.Name): dangerous_funcs = { 'eval', 'exec', 'compile', '__import_ ...[truncated 2386 chars]- Remediation
View remediation
Remediation Suggestions
- Remove in-process execution of generated Python.
- Represent CAD operations using a declarative format such as JSON with a strict schema, fixed operation names, numeric limits, and explicitly validated arguments.
- Dispatch validated operations through trusted application code rather than
exec(). - If Python execution is unavoidable, run it in a separate disposable container or sandboxed process with:
- No network access.
- A read-only root filesystem.
- A dedicated writable output directory.
- A non-privileged UID.
- CPU, memory, process, and execution-time limits.
- A restrictive syscall policy.
- No inherited credentials or sensitive environment variables.
- Remove the
--no-validateoption from normal production interfaces. - Replace deny-list validation with a small positive allow-list of permitted AST node types and backend methods. Treat this only as defense in depth, not as the primary security boundary.
- Add adversarial tests for indirect attribute traversal, inherited-class discovery, callable retrieval, malformed AST constructs, resource exhaustion, and filesystem escape attempts.