fix(code-runtime-python): bind str for dispatch's rejection message conversion

The review's remaining non-blocking suggestion: dispatch's call_failure(str(exc))
resolved the builtin str at call time, so a program rebinding __main__.str could
run a hostile callable when the binding-rejection message is formatted. Bind
_str into _run locals and use it in dispatch.
This commit is contained in:
Chinesezjc
2026-08-31 14:47:18 +08:00
committed by Tianyi Cui
parent 937ada4837
commit ac64039843
2 changed files with 6 additions and 2 deletions
@@ -690,7 +690,7 @@ describe('PythonCodeRuntime — programs and bindings', () => {
'try:',
' await tools.fail({})',
'except RuntimeError as e:',
' caught = str(e)',
' caught = e.args[0] if e.args else ""',
'except Exception as e:',
' caught = "WRONG TYPE: " + type(e).__name__',
'return caught',