fix(autogen-ext): enforce trust boundary on Docker volume mounts (OWASP ASI10)

[maxpetrusenkoagent]

Summary

Fixes #7917 (OWASP ASI10: Docker code executor mounts host filesystem without trust boundary validation).

DockerCommandLineCodeExecutor.start() accepted arbitrary host paths via extra_volumes without validating them. An agent with code-execution capability could escape the container sandbox simply by mounting /etc/passwd, /var/run/docker.sock, or any sensitive path on the host. This is the trust-boundary violation that OWASP flags as ASI10.

Changes

python/packages/autogen-ext/src/autogen_ext/code_executors/docker/_docker_code_executor.py

Adds _validate_host_volume_paths() and calls it at the start of start() before any Docker client connection is attempted (fail-closed). The validator:

1. Allowlists paths under the executor's own work_dir / bind_dir so the default sandbox workflow keeps working unchanged.
2. Rejects absolute paths resolving to well-known sensitive directories (/etc, /root, /home, /var, /usr, /proc, /sys, /var/run/docker.sock, etc.). The list is resolved against the host at import time, so /etc is correctly caught on macOS where it symlinks to /private/etc.
3. Rejects relative paths or paths containing .. that escape the workspace roots.
4. Rejects empty strings, NUL-byte injections, and non-dict bind specifications before any container is created.
5. Requires absolute paths outside the sensitive block to exist on the host so typos surface immediately.

python/packages/autogen-ext/tests/code_executors/docker/test_docker_security_validation.py (new)

Seven unit tests using a mocked docker.from_env so they do not require a running Docker daemon:

• test_sensitive_host_path_is_rejected — /etc/passwd is blocked.
• test_docker_socket_is_rejected — /var/run/docker.sock is blocked.
• test_path_traversal_is_rejected — ../../etc/passwd is blocked.
• test_relative_path_outside_workspace_is_rejected — relative paths escape attempts are blocked.
• test_workspace_path_is_allowed — paths inside work_dir continue to work.
• test_empty_path_is_rejected — empty host source path is blocked.
• test_invalid_mount_spec_is_rejected — non-dict bind specifications are blocked.

Verification

$ uv run --with pytest pytest python/packages/autogen-ext/tests/code_executors/docker/ -v
============================= test session starts ==============================
collected 7 items

python/packages/autogen-ext/tests/code_executors/docker/test_docker_security_validation.py::test_sensitive_host_path_is_rejected PASSED [ 14%]
python/packages/autogen-ext/tests/code_executors/docker/test_docker_security_validation.py::test_docker_socket_is_rejected PASSED [ 28%]
python/packages/autogen-ext/tests/code_executors/docker/test_docker_security_validation.py::test_path_traversal_is_rejected PASSED [ 42%]
python/packages/autogen-ext/tests/code_executors/docker/test_docker_security_validation.py::test_relative_path_outside_workspace_is_rejected PASSED [ 57%]
python/packages/autogen-ext/tests/code_executors/docker/test_docker_security_validation.py::test_workspace_path_is_allowed PASSED [ 71%]
python/packages/autogen-ext/tests/code_executors/docker/test_docker_security_validation.py::test_empty_path_is_rejected PASSED [ 85%]
python/packages/autogen-ext/tests/code_executors/docker/test_docker_security_validation.py::test_invalid_mount_spec_is_rejected PASSED [100%]

============================== 7 passed in 0.24s ===============================

Lint: ruff check on both touched files — All checks passed.

Test plan

• New unit tests added (7 tests, all passing).
• Existing integration tests in tests/code_executors/test_docker_commandline_code_executor.py continue to pass with a real Docker daemon.
• Maintainer review on the diff.

Notes

This is a fail-closed security fix. Any caller that previously relied on mounting sensitive paths outside work_dir / bind_dir will now see a clear ValueError explaining why the mount is refused and how to remediate.

Fixes #7917