airbytehq / airbytehq/airbyte-python-cdk

Security: Implement RestrictedPython for safer custom code execution

未关闭
#235 0 条评论 2 个 reaction 已指派 1 人 已被 @aaronsteers 认领 在 GitHub 查看
主要语言
Python
星标
26
派生
53
平均合并
2 天 6 小时
30 天内合并 PR
10

描述

## Background

Currently, the custom code compiler uses raw `exec()` to execute user-provided Python code, which could potentially be unsafe as it has unrestricted access to Python builtins and the global namespace.

## Proposed Solution

Implement [RestrictedPython](https://restrictedpython.readthedocs.io/) to provide a safer execution environment for custom code. This will:

1. Restrict access to potentially dangerous builtins
2. Run code in an isolated namespace
3. Prevent access to sensitive operations

## References

- Original PR discussion: https://github.com/airbytehq/airbyte-python-cdk/pull/174#discussion_r1917458832

## Implementation Notes

- Add RestrictedPython as a dependency
- Replace current `exec()` implementation with RestrictedPython's secure execution
- Add tests to verify security restrictions are working as expected

## Security Considerations

This enhancement will improve the security posture of the custom code execution feature by preventing potentially malicious code from accessing sensitive operations or resources.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。