fix(code-runtime-python): bind str for dispatch's rejection message conversion

The review's remaining non-blocking suggestion: dispatch's call_failure(str(exc))
resolved the builtin str at call time, so a program rebinding __main__.str could
run a hostile callable when the binding-rejection message is formatted. Bind
_str into _run locals and use it in dispatch.
This commit is contained in:
Chinesezjc authored and Tianyi Cui committed 2026-08-31 14:47:18 +08:00
1 parent 937ada4837
commit ac64039843
2 files changed
+6 -2

No files matched your search

@@ -690,7 +690,7 @@ describe('PythonCodeRuntime — programs and bindings', () => {
'try:',
' await tools.fail({})',
'except RuntimeError as e:',
' caught = str(e)',
' caught = e.args[0] if e.args else ""',
'except Exception as e:',
' caught = "WRONG TYPE: " + type(e).__name__',
'return caught',