#452 Sandbox wrapper.py JSON quoting vulnerability causes SyntaxError

closed high Created 2025-12-16 11:23 · Updated 2025-12-16 11:33

Description

Edit
In sandboxed_executor.py lines 187-188, args/kwargs are embedded in single-quoted strings: ```python args = json.loads('{args_json}') kwargs = json.loads('{kwargs_json}') ``` When JSON contains text with backslash-single-quote sequences (like \\'don\\'t\\' or escaped chars), the generated Python code has invalid syntax. **Evidence from logs:** - extract_first_n_lines task with Sherlock Holmes text (76K lines) - Sandbox fails with: SyntaxError: invalid syntax. Perhaps you forgot a comma? - Falls back to direct execution successfully **Fix:** Use triple-quoted strings or base64 encoding for safe transport

Comments

Loading comments...

Context

Loading context...

Audit History

View All
Loading audit history...