Joeven — Learn Autonomous AI Agents

← LessonPath and Host AllowlistsJoeven

Python loads on first run

import json

ROOT = "/workspace/"
PAGES = {"https://example.com/a": "hello"}
ALLOW_HOSTS = {"example.com"}

def safe_path(path):
    if not path.startswith(ROOT):
        return None
    if ".." in path.split("/"):
        return None
    return path

def read_file(path):
    ok = safe_path(path)
    if ok is None:
        return {"error": "path_denied", "path": path}
    return {"ok": True, "path": ok}

def host(url):
    parts = url.split("/")
    if len(parts) < 3:
        return ""
    return parts[2]

def http_get(url):
    h = host(url)
    if h not in ALLOW_HOSTS:
        return {"error": "blocked_host", "host": h}
    if url not in PAGES:
        return {"error": "not_found"}
    return {"body": PAGES[url]}

print("ok file", read_file("/workspace/README.md"))
print("escape", read_file("/workspace/../.env"))
print("abs", read_file("/etc/passwd"))
print("ok http", http_get("https://example.com/a"))
print("evil", http_get("https://evil.example/x"))
print("meta", json.dumps(http_get("https://169.254.169.254/latest")))

Run to execute this in your browser. Nothing is sent to a server.