unclecode 2fc39cbe89 fix(security): remove eval() from computed fields, harden config deserializer ...

- Disable eval() in _compute_field expression path (RCE vector via untrusted input).
  Expression key now logs warning and returns default; function key still works.
- Harden _safe_eval_config in server.py with name/attribute allowlists,
  block lambdas, generators, comprehensions in constructor args.
- Remove getattr/setattr from hook_manager allowed builtins (sandbox escape vectors).
- Add 67 adversarial security tests covering all eval/exec attack surfaces.

Closes #1886, closes #1855

2026-03-31 12:02:43 +00:00

..

docker

fix(security): remove eval() from computed fields, harden config deserializer

2026-03-31 12:02:43 +00:00