mirror of
https://github.com/calesthio/OpenMontage.git
synced 2026-08-18 22:38:30 +08:00
9613a3acfd
The prior dunder denylist was still bypassable via print.__self__ (the builtins module) -> .open(...), reachable with no import and no bare open/__builtins__/ getattr name. Enumerating dangerous dunders is whack-a-mole, so block ALL dunder attribute access generically and allow only the tiny set legitimate scenes need (super().__init__, occasional Type.__name__). This closes the print.__self__ / .__class__ / .__globals__ introspection-escape class at once. Static analysis still has a ceiling — a real subprocess sandbox is the complete fix — but the default path no longer executes the reported secret-read payloads. Adds regression tests for print.__self__ and for super().__init__ staying allowed. Refs #219