resolvedDetail = new LinkedHashMap<>();
resolvedDetail.put("ref", ref);
resolvedDetail.put("size", bytes.length);
prog.emit("sandbox.code_ref.resolved",
"📄 脚本就绪（" + bytes.length + " 字节，来自 " + ref + "）",
resolvedDetail);
return req.withResolvedCode(code);
}
/**
* 明确不能作为脚本跑的 mime 类型.
*
* 黑名单而非白名单：write_file 默认 mime 是 application/octet-stream（用户没传 mimeType 时），
* 这种情况应该放行——否则 LLM 走"write_file(displayName='gen.py', content=...)" 不带 mime
* 的正常路径就跑不通. 只拒绝**能肉眼判定是二进制文档**的 mime.
*
*
拒绝：docx/xlsx/pptx（OOXML）、doc/xls/ppt（老 Office）、pdf、zip、rar、7z、
* 各种 image/ audio/ video/.
*
放行：text/*、application/javascript、application/x-python、application/json、
* application/xml、application/octet-stream、null（未声明 mime）.
*/
private static boolean isBinaryMimeForCode(String mime) {
if (mime == null || mime.isEmpty()) return false;
String m = mime.toLowerCase(java.util.Locale.ROOT);
if (m.startsWith("image/")) return true;
if (m.startsWith("audio/")) return true;
if (m.startsWith("video/")) return true;
if (m.startsWith("font/")) return true;
if (m.equals("application/pdf")) return true;
if (m.equals("application/zip") || m.equals("application/x-zip-compressed")) return true;
if (m.equals("application/x-rar-compressed") || m.equals("application/vnd.rar")) return true;
if (m.equals("application/x-7z-compressed")) return true;
if (m.equals("application/x-tar") || m.equals("application/gzip")) return true;
if (m.startsWith("application/vnd.openxmlformats-")) return true; // docx/xlsx/pptx
if (m.equals("application/msword")) return true;
if (m.equals("application/vnd.ms-excel")) return true;
if (m.equals("application/vnd.ms-powerpoint")) return true;
if (m.equals("application/x-msdownload")) return true; // .exe / .dll
return false;
}
private void validate(SandboxRequest req) {
if (req == null) throw new SandboxException("sandbox.rejected", "request is null");
if (req.getThread() == null || req.getUser() == null) {
throw new SandboxException("sandbox.rejected", "thread/user required");
}
if (req.getCode() == null || req.getCode().isEmpty()) {
throw new SandboxException("sandbox.rejected", "code is empty");
}
int codeMax = LobsterConfig.getSandboxCodeMaxBytes();
int codeActual = req.getCode().getBytes(StandardCharsets.UTF_8).length;
if (codeActual > codeMax) {
// 告诉 LLM 可操作的下一步，避免反复撞同一堵墙
throw new SandboxException("sandbox.rejected",
"code too long: " + codeActual + " bytes > limit " + codeMax + " bytes. "
+ "建议拆分：(1) 把大段数据（JSON / 表格原始数据 / 模板文本）写成单独文件，"
+ "通过 input_refs 挂到 /inputs/；(2) 把通用样板代码（如 docx 政务公文骨架）"
+ "放到 skill bundle 里，用 use_skill 激活后调 /skill//scripts/ 的绝对路径；"
+ "(3) 把大脚本按功能拆成多次 code_exec 调用，中间产物走 artifactId 传递.");
}
int max = LobsterConfig.getSandboxMaxTimeoutSec();
if (req.getTimeoutSec() <= 0 || req.getTimeoutSec() > max) {
throw new SandboxException("sandbox.rejected",
"timeout_seconds out of range (1.." + max + ")");
}
}
static void validateLanguageSpecificSyntaxHints(String language, String code) {
if (!"python".equals(language) || code == null || code.isEmpty()) return;
String[] lines = code.split("\\R", -1);
for (int i = 0; i < lines.length; i++) {
String trimmed = lines[i].trim();
if (trimmed.startsWith("//")) {
throw new SandboxException("code_exec.invalid_python_syntax",
"Python script contains JavaScript-style `//` comment at line " + (i + 1)
+ ". Use `#` for Python comments, or set language='javascript' "
+ "when the script is Node/pptxgenjs code.");
}
}
}
static void validateSkillMountReferencesForCode(String code, String activatedSkill) {
if (code == null || code.isEmpty()) return;
Matcher matcher = SKILL_PATH_PATTERN.matcher(code);
Set referenced = new LinkedHashSet<>();
while (matcher.find()) {
referenced.add(matcher.group(1));
}
if (referenced.isEmpty()) return;
String activated = activatedSkill == null ? "" : activatedSkill.trim();
if (activated.isEmpty()) {
String skillId = referenced.iterator().next();
throw new SandboxException("code_exec.skill_not_activated",
"script references /skill/" + skillId + "/ but code_exec did not set "
+ "activated_skill='" + skillId + "'. Call use_skill('" + skillId
+ "') first, then pass activated_skill='" + skillId + "' in the same "
+ "code_exec call.");
}
if (!referenced.contains(activated) || referenced.size() > 1) {
throw new SandboxException("code_exec.skill_mismatch",
"script references skill bundle path(s) " + referenced
+ " but code_exec activated_skill='" + activated + "'. A code_exec call "
+ "mounts only one skill bundle under /skill//; use the matching "
+ "activated_skill or split the work into separate calls.");
}
}
static void validateInputPathReferencesForCode(String code, List inputRefs) {
if (code == null || code.isEmpty()) return;
boolean hasInputs = false;
if (inputRefs != null) {
for (String ref : inputRefs) {
if (ref != null && !ref.isEmpty()) {
hasInputs = true;
break;
}
}
}
if (!hasInputs && code.contains("/inputs/manifest.json")) {
throw new SandboxException("code_exec.missing_input_refs",
"script reads /inputs/manifest.json but this code_exec call has no input_refs. "
+ "Pass the needed artifactId/resourceId in input_refs, then read "
+ "json.load(open('/inputs/manifest.json'))[0]['path'].");
}
Matcher matcher = DIRECT_INPUT_FILE_PATTERN.matcher(code);
if (matcher.find()) {
throw new SandboxException("code_exec.invalid_input_path",
"script hard-codes input file path '" + matcher.group()
+ "'. Input filenames are staged and may be prefixed or deduplicated "
+ "(for example 00-00-name.pdf). Always read the actual path from "
+ "/inputs/manifest.json via manifest[i]['path'].");
}
}
static void validateReferencedSkillFilesExist(String code, String activatedSkill, Path skillHost) {
if (code == null || code.isEmpty()) return;
if (activatedSkill == null || activatedSkill.isEmpty() || skillHost == null) return;
Path root = skillHost.toAbsolutePath().normalize();
Matcher matcher = SKILL_FILE_PATH_PATTERN.matcher(code);
while (matcher.find()) {
String skillId = matcher.group(1);
if (!activatedSkill.equals(skillId)) continue;
String relative = matcher.group(2);
Path candidate = root.resolve(relative).normalize();
if (!candidate.startsWith(root) || !Files.exists(candidate, LinkOption.NOFOLLOW_LINKS)) {
throw new SandboxException("code_exec.skill_file_missing",
"script references " + matcher.group() + ", but the activated skill bundle "
+ activatedSkill + " does not contain " + relative + ". "
+ "Check the deployed skill bundle or use a system command already in PATH "
+ "such as `soffice` instead of a missing helper script.");
}
}
}
private List> stageInputs(SandboxRequest req, Path inputsDir) throws Exception {
List> manifest = new ArrayList<>();
int maxFiles = LobsterConfig.getSandboxInputMaxFiles();
long maxPerFile = LobsterConfig.getSandboxInputMaxBytes();
long maxTotal = LobsterConfig.getSandboxInputTotalMaxBytes();
if (req.getInputRefs().size() > maxFiles) {
throw new SandboxException("sandbox.rejected",
"too many input_refs (" + req.getInputRefs().size() + " > " + maxFiles + ")");
}
long total = 0;
int idx = 0;
for (String ref : req.getInputRefs()) {
if (ref == null || ref.isEmpty()) continue;
ResolvedFile rf;
try {
rf = resourceResolver.resolve(req.getUser(), req.getThread().getThreadId(), ref);
} catch (Exception e) {
throw new SandboxException("sandbox.rejected",
"failed to resolve input ref: " + ref + " — " + e.getMessage(), e);
}
long size = rf.getSize();
if (size > maxPerFile) {
throw new SandboxException("sandbox.rejected",
"input ref exceeds per-file limit: " + ref + " (" + size + " > " + maxPerFile + ")");
}
total += size;
if (total > maxTotal) {
throw new SandboxException("sandbox.rejected",
"input refs exceed total limit: " + total + " > " + maxTotal);
}
String safe = sanitize(rf.getDisplayName());
String ext = rf.getExtension() == null ? "bin" : rf.getExtension();
String fname = String.format("%02d-%s.%s", idx, safe, ext);
Path target = inputsDir.resolve(fname);
Files.write(target, rf.getBytes());
relaxFilePermissions(target);
Map row = new LinkedHashMap<>();
row.put("index", idx);
row.put("ref", ref);
row.put("displayName", rf.getDisplayName());
row.put("mimeType", rf.getMimeType());
row.put("size", size);
row.put("path", "/inputs/" + fname);
manifest.add(row);
idx++;
}
return manifest;
}
/**
* 扫描 outputs 目录；总大小超 50MB 或出现 symlink 直接整批拒绝.
* 不超限再逐个落 Artifact + WorkspaceResource.
*
* 安全：拒绝 symlink —— 容器内的 uid 10001 可以在 /outputs 创建
* {@code ln -s /etc/passwd outputs/exfil.txt}；Tomcat JVM 对宿主 /etc/passwd 通常有读权限，
* 若 JVM 走 follow-symlink API 读，攻击者就把宿主任意文件读进 Artifact. 这里所有
* 文件 API 都显式 NOFOLLOW_LINKS，遇到 symlink 报错整批拒绝.
*/
private void harvestOutputs(SandboxRequest req, Path outputs, SandboxResult result) throws Exception {
if (!Files.exists(outputs, LinkOption.NOFOLLOW_LINKS)) return;
long totalLimit = LobsterConfig.getSandboxOutputMaxBytes();
Path outputsAbs = outputs.toAbsolutePath().normalize();
List files = new ArrayList<>();
// Files.walk 默认不跟随 symlink 目录 —— 保持默认. 但 walk 返回的 Path 可能是指向
// 宿主外文件的 symlink；后续对每个 Path 二次判定 + NOFOLLOW 读.
try (Stream w = Files.walk(outputs)) {
w.sorted(Comparator.naturalOrder()).forEach(files::add);
}
// 阶段 1：安全 + 大小双重校验
long total = 0;
Path offender = null;
long offenderSize = 0;
String rejectReason = null;
List regularFiles = new ArrayList<>();
for (Path f : files) {
if (f.equals(outputs)) continue;
// 路径越界检查：每个条目必须真实落在 outputs 下面
Path fAbs = f.toAbsolutePath().normalize();
if (!fAbs.startsWith(outputsAbs)) {
offender = f; rejectReason = "path escapes outputs root";
break;
}
// 关键：显式 NOFOLLOW —— 任何 symlink 都拒（文件或目录）
if (Files.isSymbolicLink(f)) {
offender = f; rejectReason = "symlink not allowed";
break;
}
if (Files.isDirectory(f, LinkOption.NOFOLLOW_LINKS)) continue;
if (!Files.isRegularFile(f, LinkOption.NOFOLLOW_LINKS)) {
// FIFO / device / socket 都不收
offender = f; rejectReason = "not a regular file";
break;
}
// NOFOLLOW 读 size：Files.size(f) 会 follow symlink 去 stat 目标.
// 虽然前面 isSymbolicLink 已拦，但两次 syscall 之间存在 TOCTOU —— attacker 在容器里把 f
// 替换成指向宿主敏感路径的 symlink，Files.size 就会问到那个目标. 改用 readAttributes
// + NOFOLLOW_LINKS 一步到位，彻底关掉这个窗口.
long size = Files.readAttributes(f,
java.nio.file.attribute.BasicFileAttributes.class,
LinkOption.NOFOLLOW_LINKS).size();
total += size;
if (size > totalLimit || total > totalLimit) {
offender = f; offenderSize = size;
rejectReason = "size exceeds " + totalLimit + " bytes";
break;
}
regularFiles.add(f);
}
if (offender != null) {
result.setErrorCategory("rejected");
result.setStderr((result.getStderr() == null ? "" : result.getStderr())
+ "\n[sandbox] output rejected: " + rejectReason
+ " (file=" + offender.getFileName()
+ (offenderSize > 0 ? ", size=" + offenderSize : "") + ")");
return;
}
// 阶段 2：落盘（NOFOLLOW 读，防止 TOCTOU 攻击者在阶段 1/2 之间换成 symlink）
for (Path f : regularFiles) {
byte[] bytes = readBytesNoFollow(f);
String displayName = f.getFileName().toString();
String format = extOf(displayName);
ArtifactType type = ArtifactType.GENERATED_DOCUMENT;
Artifact a = artifactService.createBinary(req.getThread(), req.getUser(), type,
displayName, bytes, format, null, req.getRunId(), null);
WorkspaceResource r = workspaceService.registerArtifact(req.getThread(), req.getUser(), a);
SandboxResult.Produced p = new SandboxResult.Produced();
p.setResourceId(r.getResourceId());
p.setArtifactId(a.getArtifactId());
p.setDisplayName(displayName);
p.setMimeType(r.getMimeType());
p.setSize(bytes.length);
result.addProduced(p);
}
}
/**
* 读字节但不跟随 symlink. {@link Files#readAllBytes} 没有 LinkOption 重载，
* 要用 {@link Files#newInputStream} + {@link LinkOption#NOFOLLOW_LINKS}.
*/
private static byte[] readBytesNoFollow(Path p) throws IOException {
if (Files.isSymbolicLink(p)) {
throw new SandboxException("sandbox.rejected", "symlink refused: " + p);
}
try (InputStream in = Files.newInputStream(p, LinkOption.NOFOLLOW_LINKS)) {
java.io.ByteArrayOutputStream buf = new java.io.ByteArrayOutputStream();
byte[] chunk = new byte[64 * 1024];
int n;
while ((n = in.read(chunk)) > 0) buf.write(chunk, 0, n);
return buf.toByteArray();
}
}
/** displayName 清洗 —— 去除路径穿越 / 控制字符 / 非法字符. */
static String sanitize(String name) {
if (name == null || name.isEmpty()) return "unnamed";
// 剥掉扩展名（由调用方单独传 ext），只清洗主体
int dot = name.lastIndexOf('.');
String base = dot > 0 ? name.substring(0, dot) : name;
StringBuilder sb = new StringBuilder(base.length());
for (int i = 0; i < base.length(); i++) {
char c = base.charAt(i);
if (c < 0x20 || c == 0x7F) { sb.append('_'); continue; }
switch (c) {
case '/': case '\\': case ':': case '*': case '?':
case '"': case '<': case '>': case '|':
sb.append('_'); break;
default: sb.append(c);
}
}
String out = sb.toString()
.replace("..", "_")
.trim();
if (out.isEmpty()) out = "unnamed";
if (out.length() > 60) out = out.substring(0, 60);
return out;
}
/**
* Linux bind-mount 权限修复：把 dir 设为 rwxrwxrwx 让容器内 uid=10001 可写.
* POSIX 不支持的平台（Windows NTFS on Docker Desktop）静默跳过.
*/
private static void relaxPermissions(Path dir) {
if (!FileSystems.getDefault().supportedFileAttributeViews().contains("posix")) return;
try {
Set perms = EnumSet.of(
PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE, PosixFilePermission.OWNER_EXECUTE,
PosixFilePermission.GROUP_READ, PosixFilePermission.GROUP_WRITE, PosixFilePermission.GROUP_EXECUTE,
PosixFilePermission.OTHERS_READ, PosixFilePermission.OTHERS_WRITE, PosixFilePermission.OTHERS_EXECUTE);
Files.setPosixFilePermissions(dir, perms);
} catch (Throwable ignore) { /* best effort */ }
}
/**
* Files created by Tomcat can inherit a restrictive umask (for example 0600).
* The sandbox process runs as uid=10001, so bind-mounted inputs and entry
* scripts must be explicitly readable by that uid.
*/
private static void relaxFilePermissions(Path file) {
if (!FileSystems.getDefault().supportedFileAttributeViews().contains("posix")) return;
try {
Set perms = EnumSet.of(
PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE,
PosixFilePermission.GROUP_READ, PosixFilePermission.GROUP_WRITE,
PosixFilePermission.OTHERS_READ);
Files.setPosixFilePermissions(file, perms);
} catch (Throwable ignore) { /* best effort */ }
}
private static String extOf(String filename) {
if (filename == null) return "bin";
int dot = filename.lastIndexOf('.');
if (dot < 0 || dot == filename.length() - 1) return "bin";
return filename.substring(dot + 1).toLowerCase();
}
private static void deleteRecursive(Path root) throws IOException {
if (!Files.exists(root)) return;
try (Stream w = Files.walk(root)) {
w.sorted(Comparator.reverseOrder()).forEach(p -> {
try { Files.deleteIfExists(p); } catch (IOException ignore) { /* best effort */ }
});
}
}
}