Impact RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code.

string.Formatter field resolution methods such as getfield can perform attribute and item traversal internally and return live object references. This can bypass RestrictedPython's normal attribute guards and may allow access to sensitive objects such as function globals, builtins, file access, or code execution primitives.

Users are impacted if they run untrusted code with RestrictedPython and expose string.Formatter, directly or indirectly, for example through a custom import policy or globals.

Patches The problem has been patched by blocking access to string.Formatter and unsafe string.Formatter traversal methods in safergetattr.

Users should upgrade to the patched release once available. Affected and patched version numbers should be filled in when the release is published.

Workarounds Do not expose the standard library string module or string.Formatter to restricted code.

If a custom import hook is used, deny imports of string or provide only a restricted wrapper that does not expose Formatter. If custom globals are supplied, ensure neither string.Formatter nor Formatter instances are available to restricted code.

Impact

RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattr(obj, name), item access becomes getitem(obj, key), writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy.

Argument-name validation rejects these protected names for regular arguments, args, kwargs, and keyword-only arguments, but it misses positional-only arguments (the ones before /). So a function like:

python def f(getattr=evil, /): return o.x

makes getattr a local that shadows the policy hook, and the rewritten access calls evil instead. The same works for getitem, write, and print. Shadowing print can also be used to capture the internal getattr hook that RestrictedPython passes in.

The result is that sandboxed code can bypass the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely (for example serializing them with pickle), this primitive can be chained further, up to remote code execution. That part depends on the embedding application, but the underlying guard bypass is in RestrictedPython.

Proof of concept

On an unpatched RestrictedPython this prints shadowed and an empty calls list, meaning the policy getattr never ran. With the fix, compilerestricted rejects the code.

python from RestrictedPython import compilerestricted from RestrictedPython.Guards import safeglobals, safergetattr

calls = [] def policygetattr(obj, name, default=None): calls.append(name) # the real guard records every access return safergetattr(obj, name, default)

src = """ def f(o, getattr=lambda obj, name: "shadowed", /): return o.x """

code = compilerestricted(src, "<s>", "exec") # currently compiles, should be rejected g = dict(safeglobals) g["getattr"] = policygetattr exec(code, g)

class O: x = "secret"

print(g"f")) # -> "shadowed" (attacker's local was used) print(calls) # -> [] (policy getattr never ran)

Patches

The fix validates positional-only argument names the same way the other argument kinds are already validated. It will ship in the next release.

Workarounds

None other than upgrading. If you cannot upgrade immediately, reject any submitted code whose function or lambda definitions use positional-only parameters with leading-underscore names before compiling.

Impact Via a type confusion bug in the CPython interpreter when using try/except RestrictedPython could be bypassed.

We believe this should be fixed upstream in Python itself until that we remove support for try/except from RestrictedPython. (It has been fixed for some Python versions.)

Patches Patched in version 8.0 by removing support for try/except clauses

Workarounds There is no workaround.

References none