Sandbox Process Creation

Author: pixeebot[bot]

examples/other_languages.py

@@ -6,6 +6,7 @@
 from subprocess import PIPE, Popen
 
 from sigopt import Connection
+from security import safe_command
 
 
 class SubProcessEvaluator(object):
@@ -23,7 +24,7 @@ def evaluate_metric(self, assignments):
     arguments = [
       "--{}={}".format(param_name, assignment) for param_name, assignment in assignments.to_json().iteritems()
     ]
-    process = Popen(self.command.split() + arguments, stdout=PIPE, stderr=PIPE)
+    process = safe_command.run(Popen, self.command.split() + arguments, stdout=PIPE, stderr=PIPE)
     (stdoutdata, stderrdata) = process.communicate()
     sys.stderr.write(stderrdata)
     return float(stdoutdata.strip())

requirements.txt

@@ -6,3 +6,4 @@ pypng>=0.0.20
 PyYAML>=5,<7
 requests>=2.25.0,<3.0.0
 urllib3>=1.26.5,<2.0.0
+security==1.3.1

sigopt/cli/utils.py

@@ -17,6 +17,7 @@
 from sigopt.sigopt_logging import enable_print_logging, print_logger
 
 from .arguments.load_yaml import ValidatedData
+from security import safe_command
 
 
 class StreamThread(threading.Thread):
@@ -80,8 +81,7 @@ def run_subprocess_command(config, run_context, cmd, env=None):
   env = get_subprocess_environment(config, run_context, env)
   proc_stdout, proc_stderr = subprocess.PIPE, subprocess.PIPE
   try:
-    proc = subprocess.Popen(
-      cmd,
+    proc = safe_command.run(subprocess.Popen, cmd,
       env=env,
       stdout=proc_stdout,
       stderr=proc_stderr,