Skip to content

.NET: Harden LocalCodeAct OS validation #8239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
westey (westey-m) merged 2 commits into from
Sep 10, 2026
Merged

.NET: Harden LocalCodeAct OS validation #8239

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5458894
Harden LocalCodeAct OS validation
eavanvalkenburg Sep 10, 2026
b71dfcc
Address LocalCodeAct review feedback
eavanvalkenburg Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions dotnet/src/Microsoft.Agents.AI.LocalCodeAct/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,14 +100,19 @@ By default, the package validates Python code against allow-lists before
execution. The validator runs in its own short-lived Python subprocess with a
dedicated timeout (`ProcessExecutionLimits.ValidationTimeoutSeconds`).

- **Allowed imports**: `math`, `random`, `json`, `datetime`, `pathlib`, `os`
(only `os.environ`, `os.path` attributes are reachable), etc.
- **Allowed imports**: `math`, `random`, `json`, `datetime`, `pathlib`, `os`,
etc. OS access is limited to lexical `os.path` transformations and read-only
access to the scrubbed `os.environ` mapping.
- **Blocked imports**: `subprocess`, `sys`, `socket`, `importlib`, network and
threading modules, etc.
- **Allowed builtins**: `print`, `len`, `str`, type constructors, etc.
- **Blocked builtins**: `eval`, `exec`, `compile`, `__import__`, `open`,
`getattr`, `setattr`, etc.

OS-derived aliases retain the same restrictions. Filesystem-querying path
helpers, environment mutation, unknown descendants, and reflective access are
rejected by default.

See [`Resources/validator.py`](Resources/validator.py) for the full default
allow-lists.

Expand Down
Loading
Loading