sandbox: add Kotlin support to sandbox execution#140
Merged
Conversation
- Install kotlinc with SHA256 checksum in Dockerfile - Add execute_kotlin() handler - Register Kotlin in /languages, /execute, /syntax-check, and v3-service - Add test suite with CI gating (skipif no kotlinc) - Add containerized smoke test for Kotlin - Add docs Full fix for itigges22#29
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
7 tasks
itigges22
pushed a commit
that referenced
this pull request
Jul 15, 2026
Implements Ruby and PHP support for the sandbox executor, following the same pattern as Java/Kotlin support from #29/#140. Ruby and PHP are interpreted — no compile step, just syntax check + run. - Install ruby and php-cli in Dockerfile (apt-based, no manual SHA verify needed — apt's signed repo covers trust chain) - Add execute_ruby() (ruby -c + ruby) and execute_php() (php -l + php) handlers in sandbox/executor_server.py - Register ruby/php in SUPPORTED_LANGUAGES, syntax-check handlers, and language aliases (rb, php) - Add ruby/php to verified_languages + _ext_to_lang (.rb, .php) in v3-service/main.py - Register tests/infrastructure/test_sandbox_ruby_php.py in conftest.py for integration marker gating - Add test suite: execution, syntax-check, and /languages endpoint coverage for both languages, gated with skipif when ruby/php absent - Add containerized smoke tests (ruby-container-smoke, php-container-smoke) in CI — host runner has no ruby/php interpreter installed - Update docs (ARCHITECTURE.md, SUPPORT_MATRIX.md, TROUBLESHOOTING.md) Full fix for #30
itigges22
added a commit
that referenced
this pull request
Jul 15, 2026
Request-derived file paths (syntax-check filenames, Java class/package names) were already constrained — _safe_overlay_path rejects absolute and '..' paths, and the Java identifiers come from restrictive regexes — but those guards raise instead of transforming the value, which py/path-injection taint tracking cannot follow. Every language PR that touched _syntax_check_impl therefore shipped with new high-severity alerts to dismiss by hand (#140, #141), and alert 510 sat open against the java branch. _contained_path() joins under the workspace and applies the normpath + prefix check CodeQL models as a sanitizer; all ten filename-derived writes and both Java path builders now go through it. Doubles as real defense-in-depth for the Java identifiers, which previously relied on regex shape alone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Implements Kotlin support for the sandbox executor, building on the Java infrastructure from #29.
Changes
sandbox/Dockerfile/opt/kotlinc/sandbox/executor_server.pyexecute_kotlin()(compile fat JAR →java -jar),/syntax-checkhandler (full compile; no-fsyntax-onlyflag),/languagesregistration,kotlin/kt/ktsaliasesv3-service/main.py"kotlin"toverified_languages+.ktto_ext_to_langtests/infrastructure/test_sandbox_java_kotlin.pyskipif(shutil.which("kotlinc") is None)docs/ARCHITECTURE.mddocs/TROUBLESHOOTING.mdMaintainer tips addressed
-fsyntax-onlyworkaround — Kotlin lacks a syntax-only flag, so/syntax-checkdoes a full compile to a temp directory (same approach as Java). Error parsing distinguishese:errors fromw:warnings that merely mention "error".@pytest.mark.skipif(shutil.which("kotlinc") is None). The/languagesendpoint test runs unconditionally (gracefully reports"not installed").-include-runtime— bundles Kotlin stdlib into the JAR so no classpath setup is needed at runtime.kotlinc, a Docker-based smoke test verifies Kotlin end-to-end inside the sandbox container (where Kotlin 2.4.0 is installed). The host-level tests gracefully skip and the/languagesendpoint confirms registration regardless.Test output (sandbox container with Kotlin 2.4.0)
pytest -v -m integration