[GR-67458][GR-66543] Smoke-test SandboxPolicy.UNTRUSTED.

PullRequest: graalpython/3904

Author: timfel

graalpython/com.oracle.graal.python.test.integration/pom.xml

@@ -152,11 +152,6 @@ Additionally, one can change the polyglot artifacts version with
         </profile>
         <profile>
             <id>isolate</id>
-            <activation>
-                <property>
-                    <name>polyglot.engine.SpawnIsolate</name>
-                </property>
-            </activation>
             <dependencies>
                 <dependency>
                     <groupId>org.graalvm.polyglot</groupId>

graalpython/com.oracle.graal.python.test.integration/src/com/oracle/graal/python/test/integration/advanced/SandboxPolicyUntrustedTest.java

@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * The Universal Permissive License (UPL), Version 1.0
+ *
+ * Subject to the condition set forth below, permission is hereby granted to any
+ * person obtaining a copy of this software, associated documentation and/or
+ * data (collectively the "Software"), free of charge and under any and all
+ * copyright rights in the Software, and any and all patent rights owned or
+ * freely licensable by each licensor hereunder covering either (i) the
+ * unmodified Software as contributed to or provided by such licensor, or (ii)
+ * the Larger Works (as defined below), to deal in both
+ *
+ * (a) the Software, and
+ *
+ * (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
+ * one is included with the Software each a "Larger Work" to which the Software
+ * is contributed by such licensors),
+ *
+ * without restriction, including without limitation the rights to copy, create
+ * derivative works of, display, perform, and distribute the Software and make,
+ * use, sell, offer for sale, import, export, have made, and have sold the
+ * Software and the Larger Work(s), and to sublicense the foregoing rights on
+ * either these or other terms.
+ *
+ * This license is subject to the following condition:
+ *
+ * The above copyright notice and either this complete permission notice or at a
+ * minimum a reference to the UPL must be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+package com.oracle.graal.python.test.integration.advanced;
+
+import static org.junit.Assert.assertEquals;
+
+import java.io.ByteArrayOutputStream;
+
+import org.graalvm.polyglot.Context;
+import org.graalvm.polyglot.SandboxPolicy;
+import org.graalvm.polyglot.Value;
+import org.junit.Assume;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+public class SandboxPolicyUntrustedTest {
+    @BeforeClass
+    public static void setupClass() {
+        String requestedTest = System.getProperty("test");
+        Assume.assumeTrue(requestedTest != null && requestedTest.equals(SandboxPolicyUntrustedTest.class.getSimpleName()));
+    }
+
+    private static Value run(String source) {
+        ByteArrayOutputStream output = new ByteArrayOutputStream();
+        ByteArrayOutputStream errorOutput = new ByteArrayOutputStream();
+        try (Context context = Context.newBuilder("python") //
+                        .sandbox(SandboxPolicy.UNTRUSTED) //
+                        .out(output) //
+                        .err(errorOutput) //
+                        .option("engine.MaxIsolateMemory", "1GB") //
+                        .option("sandbox.MaxHeapMemory", "800MB") //
+                        .option("sandbox.MaxCPUTime", "10s") //
+                        .option("sandbox.MaxASTDepth", "100") //
+                        .option("sandbox.MaxStackFrames", "10") //
+                        .option("sandbox.MaxThreads", "1") //
+                        .option("sandbox.MaxOutputStreamSize", "1MB") //
+                        .option("sandbox.MaxErrorStreamSize", "1MB") //
+                        .build()) {
+            return context.eval("python", source);
+        }
+    }
+
+    @Test
+    public void helloworld() {
+        assertEquals("hello world", run("'hello world'").asString());
+    }
+
+    @Test
+    public void canImportBuiltinModules() {
+        assertEquals("graalpy", run("import sys; sys.implementation.name").asString());
+    }
+
+    @Test
+    public void canImportNonBuiltinModules() {
+        assertEquals("email", run("import email; email.__name__").asString());
+    }
+
+    @Test
+    public void doesNotLeakEnvironmentVariables() {
+        assertEquals("<empty>", run("import os; os.environ.get('JAVA_HOME', '<empty>')").asString());
+    }
+}

graalpython/com.oracle.graal.python.test.integration/src/com/oracle/graal/python/test/integration/engine/SharedEngineMultithreadingTestBase.java

@@ -55,8 +55,6 @@
 
 import org.graalvm.polyglot.Context;
 import org.graalvm.polyglot.Engine;
-import org.junit.Assume;
-import org.junit.BeforeClass;
 import org.junit.Rule;
 
 import com.oracle.graal.python.test.integration.CleanupRule;
@@ -75,12 +73,6 @@ public class SharedEngineMultithreadingTestBase extends PythonTests {
 
     @Rule public CleanupRule cleanup = new CleanupRule();
 
-    @BeforeClass
-    public static void setupClass() {
-        Assume.assumeFalse("Polyglot isolates may run out of socket descriptors, this is to be investigated",
-                        Boolean.getBoolean("polyglot.engine.SpawnIsolate"));
-    }
-
     protected static void log(String fmt, Object... args) {
         if (LOG) {
             System.out.printf(fmt + "\n", args);

graalpython/com.oracle.graal.python.test.integration/src/org/graalvm/python/embedding/test/integration/VirtualFileSystemIntegrationTest.java

@@ -270,8 +270,6 @@ public void fsOperations(Context ctx, String pathPrefix) {
         eval(ctx, "import os; assert os.path.exists('{pathPrefix}emptydir')", pathPrefix);
         eval(ctx, "import os; assert os.path.exists('{pathPrefix}emptydir/')", pathPrefix);
         eval(ctx, "import os; assert os.path.exists('{pathPrefix}dir1/file2')", pathPrefix);
-        Assume.assumeFalse("[GR-66484] FileNotFoundException is not translated properly to isolate and then the Python code gets a generic I/O error",
-                        Boolean.getBoolean("polyglot.engine.SpawnIsolate"));
         eval(ctx, "import os; assert not os.path.exists('{pathPrefix}doesnotexist')", pathPrefix);
         eval(ctx, "import os; assert not os.path.exists('{pathPrefix}doesnotexist/')", pathPrefix);
 

graalpython/com.oracle.graal.python/.checkstyle_checks.xml

@@ -47,7 +47,11 @@
       <property name="tokens" value="ARRAY_INIT,BNOT,DEC,DOT,INC,LNOT,UNARY_MINUS,UNARY_PLUS"/>
     </module>
     <module name="NoWhitespaceBefore">
-      <property name="tokens" value="SEMI,DOT,POST_DEC,POST_INC"/>
+      <property name="tokens" value="SEMI,POST_DEC,POST_INC"/>
+    </module>
+    <module name="NoWhitespaceBefore">
+      <property name="tokens" value="DOT"/>
+      <property name="allowLineBreaks" value="true"/>
     </module>
     <module name="ParenPad"/>
     <module name="TypecastParenPad">

graalpython/com.oracle.graal.python/src/com/oracle/graal/python/PythonLanguage.java

@@ -55,6 +55,7 @@
 import org.graalvm.options.OptionDescriptors;
 import org.graalvm.options.OptionKey;
 import org.graalvm.options.OptionValues;
+import org.graalvm.polyglot.SandboxPolicy;
 
 import com.oracle.graal.python.builtins.Python3Core;
 import com.oracle.graal.python.builtins.PythonBuiltinClassType;
@@ -147,6 +148,7 @@
 
 @TruffleLanguage.Registration(id = PythonLanguage.ID, //
                 name = PythonLanguage.NAME, //
+                sandbox = SandboxPolicy.UNTRUSTED, //
                 implementationName = PythonLanguage.IMPLEMENTATION_NAME, //
                 version = PythonLanguage.VERSION, //
                 characterMimeTypes = {PythonLanguage.MIME_TYPE,

graalpython/com.oracle.graal.python/src/com/oracle/graal/python/runtime/AsyncHandler.java

@@ -55,6 +55,8 @@
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
+import org.graalvm.polyglot.SandboxPolicy;
+
 import com.oracle.graal.python.PythonLanguage;
 import com.oracle.graal.python.builtins.objects.function.PArguments;
 import com.oracle.graal.python.builtins.objects.function.Signature;
@@ -139,7 +141,7 @@ public final void execute(PythonContext context) {
                     // Avoid pointless stack walks in random places
                     PArguments.setException(args, PException.NO_EXCEPTION);
 
-                    if (debugger == null) {
+                    if (debugger == null && !context.getEnv().getSandboxPolicy().isStricterThan(SandboxPolicy.TRUSTED)) {
                         debugger = Debugger.find(context.getEnv());
                     }
                     if (threadState == null) {
@@ -153,13 +155,17 @@ public final void execute(PythonContext context) {
                     if (!alreadyProfiling) {
                         threadState.profilingStart();
                     }
-                    debugger.disableStepping();
+                    if (debugger != null) {
+                        debugger.disableStepping();
+                    }
                     try {
                         CallDispatchers.SimpleIndirectInvokeNode.executeUncached(context.getAsyncHandler().callTarget, args);
                     } catch (PException e) {
                         handleException(e);
                     } finally {
-                        debugger.restoreStepping();
+                        if (debugger != null) {
+                            debugger.restoreStepping();
+                        }
                         if (!alreadyTracing) {
                             threadState.tracingStop();
                         }

mx.graalpython/mx_graalpython.py

@@ -1247,13 +1247,21 @@ def graalpython_gate_runner(args, tasks):
             env['JAVA_HOME'] = graalvm_jdk(enterprise=True)
             mx.run_maven(mvn_cmd_base + [
                 '-U',
+                '-Pisolate',
                 '-Dpolyglot.engine.AllowExperimentalOptions=true',
                 '-Dpolyglot.engine.SpawnIsolate=true',
                 '-Dpolyglot.engine.IsolateMode=external',
                 'clean',
                 'test',
             ], env=env)
 
+            mx.log("Running integration JUnit tests on GraalVM SDK with untrusted sandbox policy")
+            mx.run_maven(mvn_cmd_base + [
+                '-Pisolate',
+                '-Dtest=SandboxPolicyUntrustedTest',
+                'test',
+            ], env=env)
+
     # Unittests on JVM
     with Task('GraalPython JVM build', tasks, tags=[GraalPythonTags.jvmbuild]) as task:
         if task: