Allow setting a binary_path when calling /eval

Author: ChrisLovering

config/snekbox.cfg

@@ -103,8 +103,3 @@ cgroup_pids_max: 6
 cgroup_pids_mount: "/sys/fs/cgroup/pids"
 
 iface_no_lo: true
-
-exec_bin {
-    path: "/lang/python/default/bin/python"
-    arg: ""
-}

snekbox/api/resources/eval.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import logging
+from pathlib import Path
 
 import falcon
 from falcon.media.validators.jsonschema import validate
@@ -44,6 +45,7 @@ class EvalResource:
                     "required": ["path"],
                 },
             },
+            "binary_path": {"type": "string"},
         },
         "anyOf": [
             {"required": ["input"]},
@@ -123,10 +125,18 @@ def on_post(self, req: falcon.Request, resp: falcon.Response) -> None:
         if "input" in body:
             body.setdefault("args", ["-c"])
             body["args"].append(body["input"])
+
+        binary_path = body.get("binary_path")
+        if binary_path:
+            binary_path = Path(binary_path)
+            if not binary_path.as_posix().startswith("/lang/") or not binary_path.is_file():
+                raise falcon.HTTPBadRequest(title="binary_path file is invalid")
+
         try:
             result = self.nsjail.python3(
                 py_args=body["args"],
                 files=[FileAttachment.from_dict(file) for file in body.get("files", [])],
+                binary_path=binary_path,
             )
         except ParsingError as e:
             raise falcon.HTTPBadRequest(title="Request file is invalid", description=str(e))

snekbox/nsjail.py

@@ -190,8 +190,11 @@ def python3(
             files: FileAttachments to write to the sandbox prior to running Python.
             nsjail_args: Overrides for the NsJail configuration.
             binary_path: The path to the binary to execute under.
-                If None, defaults to exec_bin.path from nsjail config
+                If None, defaults to "/lang/python/default/bin/python"
         """
+        if not binary_path:
+            binary_path = "/lang/python/default/bin/python"
+
         if self.cgroup_version == 2:
             nsjail_args = ("--use_cgroupv2", *nsjail_args)
 
@@ -215,7 +218,6 @@ def python3(
                 f"{fs.home}:home",
                 *nsjail_args,
             )
-
             args = [
                 self.nsjail_path,
                 "--config",
@@ -224,7 +226,7 @@ def python3(
                 nsj_log.name,
                 *nsjail_args,
                 "--",
-                binary_path or self.config.exec_bin.path,
+                binary_path,
                 # Filter out empty strings at start of Python args
                 # (causes issues with python cli)
                 *iter_lstrip(self.config.exec_bin.arg),