>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #940
Update issue details
Title *
Description
EARS: If a workflow task names a function for tools.python.run, the engine shall only import and call functions from an explicit allowlist of modules, and shall not import or importlib.reload arbitrary modules on the worker. Found during #915/#939. engine/tools/python_task.py run_python_task does importlib.import_module(module_path) and importlib.reload(module) for ANY tenant-supplied dotted name, then calls func(ctx, *args, **kwargs) in the worker process (root, docker.sock, DB pool, Vault tokens in env). ctx is forced as the first argument, which blocks the obvious os.system/subprocess gadgets, but import side effects, reload of engine modules (global state reset in a live worker), and any callable that accepts an arbitrary first object remain. ARTIFACT mode also exec()s stored source in-process. Not fixed by #915 (sandbox covers shell/code.exec/app shell only). Needs: module allowlist (config), no reload of non-allowlisted modules, and a gadget audit.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel