From 6d0146a3f34e009420444f9262a2489b2909459b Mon Sep 17 00:00:00 2001 From: lzhan011 <35493221+lzhan011@users.noreply.github.com> Date: Wed, 2 Sep 2026 16:17:30 -0500 Subject: [PATCH 1/2] fix(guardrails): wire _unpack_sequence_ into the custom-code sandbox RestrictedPython rewrites every tuple-unpacking target that is not a for-loop target into a call to _unpack_sequence_, and ships no default for it -- the same way it ships no _inplacevar_, which this module already supplies. The sandbox globals never defined it, so ordinary guardrail code compiled cleanly and then raised NameError on its first run: a, b = pair a, (b, c) = nested a, *rest = seq with ctx as (a, b): RestrictedPython.Guards.guarded_unpack_sequence is the helper the rewritten bytecode expects, and it applies the same _getiter_ guard to each element that guarded_iter_unpack_sequence already applies for `for a, b in x`. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0147HaHohHPnpFBUa4tUkvPg --- .../guardrail_hooks/custom_code/sandbox.py | 7 +++++ .../guardrails/test_custom_code_security.py | 29 +++++++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/litellm/proxy/guardrails/guardrail_hooks/custom_code/sandbox.py b/litellm/proxy/guardrails/guardrail_hooks/custom_code/sandbox.py index 35f1e6e6515..1588836f681 100644 --- a/litellm/proxy/guardrails/guardrail_hooks/custom_code/sandbox.py +++ b/litellm/proxy/guardrails/guardrail_hooks/custom_code/sandbox.py @@ -31,6 +31,7 @@ from RestrictedPython.Eval import default_guarded_getitem, default_guarded_getit from RestrictedPython.Guards import ( full_write_guard, guarded_iter_unpack_sequence, + guarded_unpack_sequence, safer_getattr, ) @@ -115,6 +116,12 @@ def build_sandbox_globals() -> dict[str, object]: "_getitem_": default_guarded_getitem, "_getiter_": default_guarded_getiter, "_iter_unpack_sequence_": guarded_iter_unpack_sequence, + # RestrictedPython emits _unpack_sequence_ for every tuple-unpacking + # target that is not a for-loop target — ``a, b = pair``, + # ``a, *rest = seq``, ``with x as (a, b)`` — and, like _inplacevar_, + # ships no default. Without it those statements compile and then raise + # NameError the first time the guardrail runs. + "_unpack_sequence_": guarded_unpack_sequence, "_write_": full_write_guard, "_inplacevar_": _inplacevar_, } diff --git a/tests/test_litellm/proxy/guardrails/test_custom_code_security.py b/tests/test_litellm/proxy/guardrails/test_custom_code_security.py index f93ecfc3010..d245096764d 100644 --- a/tests/test_litellm/proxy/guardrails/test_custom_code_security.py +++ b/tests/test_litellm/proxy/guardrails/test_custom_code_security.py @@ -228,3 +228,32 @@ def test_augmented_assignment_works(): def test_missing_apply_guardrail_raises(): with pytest.raises(CustomCodeCompilationError, match="apply_guardrail"): _compile("x = 1\n") + + +@pytest.mark.parametrize( + ("body", "expected"), + [ + # Every one of these compiles fine and then raises + # "NameError: name '_unpack_sequence_' is not defined" at call time when + # the guard is missing from the sandbox globals. + (" a, b = inputs['pair']\n return a + b\n", 3), + (" a, (b, c) = inputs['nested']\n return a + b + c\n", 6), + (" a, *rest = inputs['seq']\n return rest\n", [2, 3]), + (" with inputs['ctx'] as (a, b):\n return a + b\n", 15), + ], +) +def test_tuple_unpacking_runs(body: str, expected): + """Ordinary tuple unpacking must work inside a guardrail, not NameError.""" + + class _Ctx: + def __enter__(self): + return (7, 8) + + def __exit__(self, *args): + return False + + guardrail = _compile("def apply_guardrail(inputs, request_data, input_type):\n" + body) + fn = guardrail._compiled_function + assert fn is not None + inputs = {"pair": (1, 2), "nested": (1, (2, 3)), "seq": [1, 2, 3], "ctx": _Ctx()} + assert fn(inputs, {}, "request") == expected From 9dcaca25223573a7fcbc937cc0dca2da0de561a8 Mon Sep 17 00:00:00 2001 From: lzhan011 <35493221+lzhan011@users.noreply.github.com> Date: Wed, 2 Sep 2026 16:18:27 -0500 Subject: [PATCH 2/2] fix(guardrails): apply the `with` guards to `async with` in the sandbox AsyncAwareTransformer re-permits the async nodes the RestrictedPython policy rejects outright. AsyncFunctionDef delegates to visit_FunctionDef so it inherits that visitor's checks, but AsyncWith went to node_contents_visit, which only recurses into children and performs no rewriting. The result was that the async spelling enforced less than the sync one: `with x as (a, b)` is rewritten to guard the unpacking, `async with x as (a, b)` was not. AsyncWith has the same _fields and the same security semantics as With, so delegate to visit_With the way AsyncFunctionDef delegates to visit_FunctionDef. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0147HaHohHPnpFBUa4tUkvPg --- .../guardrail_hooks/custom_code/sandbox.py | 7 ++- .../guardrails/test_custom_code_security.py | 54 +++++++++++++++++++ 2 files changed, 59 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/guardrails/guardrail_hooks/custom_code/sandbox.py b/litellm/proxy/guardrails/guardrail_hooks/custom_code/sandbox.py index 1588836f681..d5707894a9d 100644 --- a/litellm/proxy/guardrails/guardrail_hooks/custom_code/sandbox.py +++ b/litellm/proxy/guardrails/guardrail_hooks/custom_code/sandbox.py @@ -45,7 +45,10 @@ class AsyncAwareTransformer(RestrictingNodeTransformer): has the same ``_fields`` as ``FunctionDef`` and the same security semantics, so we delegate to ``visit_FunctionDef`` — name check, argument check, print-scope wrapping, and any future additions to that method are - inherited automatically. ``AsyncFor``/``AsyncWith``/``Await`` delegate to + inherited automatically. ``AsyncWith`` gets the same treatment for the same + reason: ``node_contents_visit`` only recurses into children, so routing it + there left ``async with x as (a, b)`` without the unpack guard that + ``with x as (a, b)`` gets. ``AsyncFor``/``Await`` delegate to ``node_contents_visit`` so their children still get transformed. """ @@ -56,7 +59,7 @@ class AsyncAwareTransformer(RestrictingNodeTransformer): return self.node_contents_visit(node) def visit_AsyncWith(self, node: ast.AsyncWith) -> ast.AST: - return self.node_contents_visit(node) + return self.visit_With(node) def visit_Await(self, node: ast.Await) -> ast.AST: return self.node_contents_visit(node) diff --git a/tests/test_litellm/proxy/guardrails/test_custom_code_security.py b/tests/test_litellm/proxy/guardrails/test_custom_code_security.py index d245096764d..679c0966828 100644 --- a/tests/test_litellm/proxy/guardrails/test_custom_code_security.py +++ b/tests/test_litellm/proxy/guardrails/test_custom_code_security.py @@ -257,3 +257,57 @@ def test_tuple_unpacking_runs(body: str, expected): assert fn is not None inputs = {"pair": (1, 2), "nested": (1, (2, 3)), "seq": [1, 2, 3], "ctx": _Ctx()} assert fn(inputs, {}, "request") == expected + + +def _guard_names(source: str) -> set[str]: + """Names of the RestrictedPython guards the compiled bytecode calls.""" + import types + + from litellm.proxy.guardrails.guardrail_hooks.custom_code.sandbox import ( + compile_sandboxed, + ) + + found: set[str] = set() + stack = [compile_sandboxed(source)] + while stack: + code = stack.pop() + found |= {n for n in code.co_names + code.co_varnames if n.startswith("_") and n.endswith("_")} + stack += [c for c in code.co_consts if isinstance(c, types.CodeType)] + return found + + +def test_async_with_gets_the_same_guards_as_with(): + """`async with` is the async spelling of `with`; it must not enforce less.""" + sync_guards = _guard_names("def f(x):\n with x as (a, b):\n pass\n") + async_guards = _guard_names("async def f(x):\n async with x as (a, b):\n pass\n") + + assert "_unpack_sequence_" in sync_guards, "precondition: `with` unpacking is guarded" + assert sync_guards <= async_guards + + +@pytest.mark.asyncio +async def test_async_with_still_executes(): + """Guarding `async with` must not break it.""" + from litellm.proxy.guardrails.guardrail_hooks.custom_code.sandbox import ( + build_sandbox_globals, + compile_sandboxed, + ) + + class _ACtx: + def __init__(self, value): + self.value = value + + async def __aenter__(self): + return self.value + + async def __aexit__(self, *args): + return False + + sandbox_globals = build_sandbox_globals() + exec( # noqa: S102 + compile_sandboxed( + "async def f(ctx):\n async with ctx as (a, b):\n return a + b\n" + ), + sandbox_globals, + ) + assert await sandbox_globals["f"](_ACtx((5, 6))) == 11