mirror of
https://github.com/RustPython/RustPython.git
synced 2026-10-29 03:04:38 +08:00
Jeong, YunWonandgithub-actions[bot]
b877f76141
* Add host_env feature for sandbox isolation Introduce a `host_env` feature flag that gates all host environment access (filesystem, network, signals, processes). When disabled, the VM operates in sandbox mode: - _io module always available; FileIO gated by host_env - SandboxStdio provides lightweight stdin/stdout/stderr via Rust std::io - BytesIO/StringIO/BufferedIO/TextIOWrapper work without host_env - open() returns UnsupportedOperation in sandbox - stdlib modules (os, socket, signal, etc.) gated by host_env - CI checks both host_env ON and OFF builds * Auto-format: ruff check --select I --fix --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
56 lines
1.3 KiB
Python
56 lines
1.3 KiB
Python
"""Sandbox mode smoke test.
|
|
|
|
Verifies basic functionality that works in both sandbox and normal mode:
|
|
- stdio (print, sys.stdout/stdin/stderr)
|
|
- builtin modules (math, json)
|
|
- in-memory IO (BytesIO, StringIO)
|
|
- open() is properly blocked when FileIO is unavailable (sandbox)
|
|
"""
|
|
|
|
import _io
|
|
import json
|
|
import math
|
|
import sys
|
|
|
|
SANDBOX = not hasattr(_io, "FileIO")
|
|
|
|
# stdio
|
|
print("1. print works")
|
|
assert sys.stdout.writable()
|
|
assert sys.stderr.writable()
|
|
assert sys.stdin.readable()
|
|
assert sys.stdout.fileno() == 1
|
|
|
|
# math
|
|
assert math.pi > 3.14
|
|
print("2. math works:", math.pi)
|
|
|
|
# json
|
|
d = json.loads('{"a": 1}')
|
|
assert d == {"a": 1}
|
|
print("3. json works:", d)
|
|
|
|
# BytesIO / StringIO
|
|
buf = _io.BytesIO(b"hello")
|
|
assert buf.read() == b"hello"
|
|
sio = _io.StringIO("world")
|
|
assert sio.read() == "world"
|
|
print("4. BytesIO/StringIO work")
|
|
|
|
# open() behavior depends on mode
|
|
if SANDBOX:
|
|
try:
|
|
open("/tmp/x", "w")
|
|
assert False, "should have raised"
|
|
except _io.UnsupportedOperation:
|
|
print("5. open() properly blocked (sandbox)")
|
|
else:
|
|
print("5. open() available (host_env)")
|
|
|
|
# builtins
|
|
assert list(range(5)) == [0, 1, 2, 3, 4]
|
|
assert sorted([3, 1, 2]) == [1, 2, 3]
|
|
print("6. builtins work")
|
|
|
|
print("All smoke tests passed!", "(sandbox)" if SANDBOX else "(host_env)")
|