Skip to content

fix: harden syft-restrict against verifier and obfuscator bypasses #9436

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pjwerneck wants to merge 27 commits into
base: dev
Choose a base branch
from
+3,013 −834
Open

fix: harden syft-restrict against verifier and obfuscator bypasses #9436

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
2d2f548
Fix common aliased identifier bypass case
pjwerneck Jul 3, 2026
1268fbe
Fix self.* call vetting.
pjwerneck Jul 3, 2026
4daaa7f
Improve call vetting to include checks for bare names imported as ali…
pjwerneck Jul 3, 2026
2cfe2cf
Add banned names to denylist: type, __build_class__, and print
pjwerneck Jul 3, 2026
1502f4a
Enhance policy to include additional banned names and better checks f…
pjwerneck Jul 3, 2026
888f9b3
Enhance self/cls parameter vetting and add tests for reassignment and…
pjwerneck Jul 3, 2026
4eeca96
Add regression tests for bypasses and update f-string handling.
pjwerneck Jul 6, 2026
c69587a
Simplify README.md and update docs/
pjwerneck Jul 6, 2026
5cc5267
Enhance range normalization and verification; add tests for f-string …
pjwerneck Jul 6, 2026
fc54f9d
Add alias tracking for self attributes to prevent trust bypasses
pjwerneck Jul 6, 2026
085f0a0
pre-commit fixes
pjwerneck Jul 6, 2026
8c99d39
Apply suggestions from code review
pjwerneck Jul 7, 2026
5808248
small changes
koenvanderveen Jul 8, 2026
4ce5ab8
refactor: user-configurable disallow list and simpler call/base checks
koenvanderveen Jul 9, 2026
36b01b6
Change references from hidden/visible to private/public for consisten…
pjwerneck Jul 9, 2026
ed09024
Converted _check_call to default-deny semantics
pjwerneck Jul 9, 2026
432aa35
Simplify comments and docstrings in verifier
pjwerneck Jul 9, 2026
7ddd0b7
refactor: ban f-strings outright and update related documentation and…
pjwerneck Jul 9, 2026
473ddaa
Add tests for self attribute aliasing and call target safety
pjwerneck Jul 9, 2026
2dc39b0
Removed redundant checks
pjwerneck Jul 9, 2026
1aca348
Normalize assignment handling
pjwerneck Jul 9, 2026
7272855
Simplify alias tracking
pjwerneck Jul 9, 2026
4caa891
fix: initialize safe locals stack with a default frame and add test f…
pjwerneck Jul 9, 2026
e5ee927
Refactor tests for disallowed constructs, whitelisted library calls, …
pjwerneck Jul 10, 2026
de1265a
Enhance private definition handling and add comprehensive tests for r…
pjwerneck Jul 10, 2026
a85e094
pre-commit fixes
pjwerneck Jul 10, 2026
0132cc1
Rewrote docs for clarity, aligned with tests.
pjwerneck Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
290 changes: 44 additions & 246 deletions packages/syft-restrict/README.md
View file
Open in desktop

Large diffs are not rendered by default.

27 changes: 0 additions & 27 deletions packages/syft-restrict/disallowed-ast-examples.md
View file
Open in desktop

This file was deleted.

Loading
Loading