Code verifier returns VERIFIED and admits code that runs shell commands

Impact

CodeVerifier.verify_code(), CodeVerifier.verify_python_deep() and the /verify/code API route treat shell and subprocess calls as warnings rather than blocking findings. Python code that calls os.system, os.popen, subprocess.call or subprocess.Popen is returned with:

• status VERIFIED;
• developer_fields.is_valid = True;
• a proof_ref;
• admission ADMIT.

Most callers act on VERIFIED or ADMIT. An application that runs model-generated code only after QWED admits it can therefore be led to run arbitrary shell commands chosen by the model or by whoever controls the model's input.

The warning-level classification is in src/qwed_new/core/code_verifier.py (PYTHON_WARNING).

Proof of concept

from qwed_new.core.code_verifier import CodeVerifier
from qwed_new.core.diagnostics import admission_decision

r = CodeVerifier().verify_code('import os\nos.system("rm -rf /tmp/qwed-poc")')
print(r.status.value, admission_decision(r).value, r.developer_fields["is_valid"])
# VERIFIED ADMIT True

Patches

Fixed in 7.2.3. The following now produce a blocking finding: shell and process-execution calls, including os.system, os.popen, the os.exec* and os.spawn* families, and subprocess.*, whether called directly or through an alias. Code that contains them is never admitted.

Workarounds

Until you upgrade, do not run code on the basis of a VERIFIED / ADMIT result alone. Also reject any result whose developer_fields.issues contains a WARNING. Run generated code only inside an isolated sandbox.