#452 Sandbox wrapper.py JSON quoting vulnerability causes SyntaxError
Description
EditIn sandboxed_executor.py lines 187-188, args/kwargs are embedded in single-quoted strings:
```python
args = json.loads('{args_json}')
kwargs = json.loads('{kwargs_json}')
```
When JSON contains text with backslash-single-quote sequences (like \\'don\\'t\\' or escaped chars), the generated Python code has invalid syntax.
**Evidence from logs:**
- extract_first_n_lines task with Sherlock Holmes text (76K lines)
- Sandbox fails with: SyntaxError: invalid syntax. Perhaps you forgot a comma?
- Falls back to direct execution successfully
**Fix:** Use triple-quoted strings or base64 encoding for safe transport
Comments
Loading comments...
Context
Loading context...
Audit History
View AllLoading audit history...