Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Studio's Office formats run model-written Python unsandboxed in the worker

Aperta
  • Qualcosa non va?
#1,999 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@Cedric921 ci sta già lavorando.

Dal 6/10/2026.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python
Ambito
backend, security

Direzione di ricerca

Read CONTRIBUTING.md, docs/architecture/studio.md, ADR 0010 and ADR 0028, then review the proposal header in docs/README.md. Trace the current runner in surfsense_local/backend/worker/studio/office/runner.py and its pipeline seam in pipeline.py; use test_studio_office.py to understand existing coverage. Done for this first contribution is a proposal in docs/proposals/ choosing an approach, documenting platform coverage, approval and repair-loop behavior, and its tradeoffs.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

architecture desktop help wanted security

The gap

docs/architecture/studio.md lists this under Known gaps:

DOCX, PPTX, XLSX and PDF run model-written Python with exec() in the worker process, unsandboxed and without asking the user; the 120-second limit cannot stop a runaway thread.

Why it matters

The model that writes that Python has just read the user's own documents, and a document is untrusted input: it can carry instructions aimed at the model. What comes back is executed with the worker's privileges, on the user's machine, with reach into their data directory and the network, and the user is never asked. Nothing distinguishes a script that builds a spreadsheet from a script that reads ~/.surfsense and posts it somewhere; both are just output_bytes by the time the job finishes.

This is the one place where the app's own rule does not hold. ADR 0010 says the model emits structured content and a committed builder renders it, which turns "arbitrary code" into "malformed JSON"; eight of the twelve formats still work that way. ADR 0028 accepted the four that do not, and left open whether they should ask.

This needs a design before it needs code, and the right first contribution is a proposal in docs/proposals/, not a PR. The realistic shapes are an out-of-process runner the worker can kill and confine, an OS-level sandbox per platform, asking the user to approve the script the way ADR 0028 makes the agent's shell tool ask, or returning these four formats to ADR 0010's builder rule and giving up on model-written layout. Whichever you favour, say what it costs on Windows, macOS and Linux: the app is offline-first and has no Docker, which is what ruled the hosted sandbox out to begin with. Comment here before you start writing, so we can agree the direction.

Where

What done looks like

  • For the proposal: one approach chosen, with the platforms it covers and the ones it does not, what happens to the three-attempt repair loop in render(), and whether the user is asked. For the code that follows: a script that tries to open a network connection or read outside the data directory does not succeed, and a script that loops forever is stopped rather than waited out.
  • Whichever way it goes, the fixing change deletes two Known-gap lines, not one: the line above in docs/architecture/studio.md, and the cross-reference in docs/architecture/egress.md — "The Office Studio formats run model-written code in the worker, and that code can open connections of its own (studio)." Egress carries it because that code can open connections egress.require() never sees.
  • The Studio doc's The builder rule, and where it is broken section describes the current behaviour in detail and is updated to match whatever lands.
  • An accepted ADR is not rewritten. If the answer reverses ADR 0010 or ADR 0028, the PR carries a new ADR that supersedes it.

What not to change

Do not bolt a partial sandbox onto the current runner. A blocklist of imports, a stripped __builtins__, or a RestrictedPython-style namespace filter is defeated in a dozen documented ways, and shipping one would be worse than the honest ponytail: comment sitting there now, because it would read as a guarantee to the next person who looks.

Leave the eight formats that follow the builder rule alone. They are the part of Studio that works as designed, and the fix here is for the four that do not.

How to verify

surfsense_local/backend/tests/unit/worker/test_studio_office.py drives the runner today, including a script that hangs and one that raises. Write the failing test first: a generated script that reaches something it should not, asserted to fail rather than to succeed.

cd surfsense_local/backend
uv run pytest -m unit
uv run pytest -m integration
uv run ruff check .
cd ../.. && python scripts/check_docs.py

Before you start

Read CONTRIBUTING.md, the Studio doc, ADR 0010 and ADR 0028. docs/README.md has the header a proposal needs. Report anything exploitable today through SECURITY.md rather than in this thread. Open your PR against dev, not main. Comment here to claim this.

Lingua principale
Python
Stelle
16.3k
Fork
1.6k
Merge medio
13h 35m
PR unite (30g)
267

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di MODSetter/SurfSense

Tutte le issue di MODSetter/SurfSense

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.