Skip to content

šŸ›”ļø Sentinel: [MEDIUM] Block function reflection attributes in ASTScanner #290

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weā€™ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
traoreera merged 1 commit into from
Oct 6, 2026
Merged

šŸ›”ļø Sentinel: [MEDIUM] Block function reflection attributes in ASTScanner #290

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions tests/unit/security/test_sentinel_fixes.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,3 +52,31 @@ def test_ast_scanner_blocks_new_forbidden_modules(tmp_path):
assert "import interdit ā€” 'termios'" in error_msgs
assert "import interdit ā€” 'tty'" in error_msgs
assert "import interdit ā€” 'fcntl'" in error_msgs


def test_ast_scanner_blocks_reflection_forbidden_attributes(tmp_path):
src_dir = tmp_path / "src"
src_dir.mkdir()

code = """
def check_func(f):
c = f.__closure__
d = f.__defaults__
kd = f.__kwdefaults__
fn = f.__func__
s = f.__self__
m = f.__module__
"""
(src_dir / "main.py").write_text(code)

scanner = ASTScanner()
result = scanner.scan(tmp_path)

assert not result.passed
error_msgs = "\n".join(result.errors)
assert "attribut interdit : '__closure__'" in error_msgs
assert "attribut interdit : '__defaults__'" in error_msgs
assert "attribut interdit : '__kwdefaults__'" in error_msgs
assert "attribut interdit : '__func__'" in error_msgs
assert "attribut interdit : '__self__'" in error_msgs
assert "attribut interdit : '__module__'" in error_msgs
6 changes: 6 additions & 0 deletions xcore/kernel/security/section.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,12 @@
"__globals__",
"__subclasses__",
"__code__",
"__closure__",
"__defaults__",
"__kwdefaults__",
"__func__",
"__self__",
"__module__",
Comment on lines +31 to +36

@sourcery-ai sourcery-ai Bot Oct 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

šŸŸ  High Ā· String helpers bypass attribute blocking

When a plugin passes a newly forbidden reflection name to an attrgetter helper, ASTScanner checks only ast.Attribute names, so it misses names passed as strings to operator.attrgetter or functools.attrgetter. The scan passes and the plugin can still inspect function internals.

Have ASTScanner reject newly forbidden names passed to attrgetter helpers.

Prompt for AI agents 
In `xcore/kernel/security/section.py` at lines 31-36:

**String helpers bypass attribute blocking**

When a plugin passes a newly forbidden reflection name to an `attrgetter` helper, `ASTScanner` checks only `ast.Attribute` names, so it misses names passed as strings to `operator.attrgetter` or `functools.attrgetter`. The scan passes and the plugin can still inspect function internals.

Have `ASTScanner` reject newly forbidden names passed to `attrgetter` helpers.

Comment on lines +31 to +36

@sourcery-ai sourcery-ai Bot Oct 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

šŸŸ  High Ā· Ephemeral plugins run after failed scans

When an EPHEMERAL-mode plugin uses a newly forbidden attribute, EphemeralActivator.activate logs the scan errors and continues to EphemeralHandler.start, whose warm pool loads the plugin through the in-process LifecycleManager. The forbidden reflection access therefore runs in the kernel process.

Make EphemeralActivator.activate stop activation when the scan fails.

Prompt for AI agents 
In `xcore/kernel/security/section.py` at lines 31-36:

**Ephemeral plugins run after failed scans**

When an EPHEMERAL-mode plugin uses a newly forbidden attribute, `EphemeralActivator.activate` logs the scan errors and continues to `EphemeralHandler.start`, whose warm pool loads the plugin through the in-process `LifecycleManager`. The forbidden reflection access therefore runs in the kernel process.

Make `EphemeralActivator.activate` stop activation when the scan fails.

Comment on lines +31 to +36

@sourcery-ai sourcery-ai Bot Oct 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

āšŖ Low Ā· Security guide omits blocked attributes

The sandboxed-plugin guide lists __subclasses__, __mro__, __globals__, and __builtins__ as blocked attributes but omits the six added here, so plugin authors relying on the guide do not learn that these accesses are rejected during scanning.

Update the sandboxed-plugin guideā€™s blocked-attribute list to include the six new entries.

Prompt for AI agents 
In `xcore/kernel/security/section.py` at lines 31-36:

**Security guide omits blocked attributes**

The sandboxed-plugin guide lists `__subclasses__`, `__mro__`, `__globals__`, and `__builtins__` as blocked attributes but omits the six added here, so plugin authors relying on the guide do not learn that these accesses are rejected during scanning.

Update the sandboxed-plugin guideā€™s blocked-attribute list to include the six new entries.

"__mro__",
"__builtins__",
"__dict__",
Expand Down
Loading