Security: Fix Path Traversal in LocalCommandLineCodeExecutor

[glmgbj233]

Summary

This PR addresses a critical security vulnerability in LocalCommandLineCodeExecutor where executed Python code could perform path traversal to write files outside the designated work_dir.

Prior to this fix, an agent could execute code like open('../../pwned.txt', 'w') to overwrite arbitrary files on the host system, potentially leading to Remote Code Execution (RCE).

Changes

• Implemented Strict Path Validation:
  • Added a SECURITY_PREAMBLE that utilizes sys.addaudithook (Python 3.8+) to intercept low-level file operations (open, io.open, os.open).
  • The audit hook inspects file write operations and strictly enforces that the resolved target path must reside within the resolved current working directory (cwd).
  • Attempts to write outside the work_dir now raise a PermissionError.
• Code Injection:
  • Modified _execute_code_dont_check_setup in autogen_ext/code_executors/local/__init__.py to prepend this security preamble to all Python code blocks before execution.

[glmgbj233]

@microsoft-github-policy-service agree