fix(internal): reject non-Name/Attribute call targets in python_sandbox (#772)

* fix(internal): reject non-Name/Attribute call targets in python_sandbox

Adds else branch to ast.Call validation so subscript calls (config['fn']())
and chained calls (config.get('fn')()) are rejected instead of silently
passing. The sandbox documented that only named functions and whitelisted
methods are allowed -- this makes that guarantee accurate.

In production config is always JSON-deserialized (no callables possible),
so there is no user-facing impact.

Credits: @restriction (responsible disclosure)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs(internal): clarify python_sandbox is not a security boundary

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(internal): add regression tests for subscript and chained call blocking

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: julienld

README.md

@@ -245,6 +245,7 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
 - **[@saphid](https://github.com/saphid)** — Config entry options flow tools (initial design, #590).
 - **[@adraguidev](https://github.com/adraguidev)** — Fix menu-based config entry flows for group helpers (#647).
 - **[@transportrefer](https://github.com/transportrefer)** — Integration options inspection (`ha_get_integration` schema support, #689).
+- **[@restriction](https://github.com/restriction)** — Responsible disclosure: python_transform sandbox missing call target validation.
 
 ---
 

src/ha_mcp/utils/python_sandbox.py

@@ -1,8 +1,9 @@
 """
-Python expression sandbox using AST validation.
+Python expression validation for dashboard transformations.
 
-Provides safe execution of Python expressions for dashboard transformations.
-Blocks imports, file I/O, dangerous builtins, and common sandbox escapes.
+Restricts expressions to a known-safe subset: dict/list operations,
+basic control flow, and whitelisted methods. Not a security boundary —
+callers are already authenticated MCP users with full HA access.
 """
 
 import ast
@@ -189,6 +190,11 @@ def validate_expression(expr: str) -> tuple[bool, str]:
                         f"Forbidden method: {method_name} (allowed: {', '.join(sorted(SAFE_METHODS))})",
                     )
 
+            # Reject subscript calls, chained calls, and all other non-standard targets
+            # e.g., config['fn']() or config.get('fn')() would bypass Name/Attribute checks
+            else:
+                return False, f"Forbidden call target type: {type(node.func).__name__}"
+
         # Block function definitions (could be used for obfuscation)
         if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
             return False, "Forbidden: function/class definitions not allowed"

tests/src/unit/test_python_sandbox.py

@@ -129,6 +129,20 @@ def test_block_forbidden_method(self):
         assert valid is False
         assert "method" in error.lower()
 
+    def test_block_subscript_call(self):
+        """Test that calls on subscript results are blocked."""
+        expr = "config['fn']()"
+        valid, error = validate_expression(expr)
+        assert valid is False
+        assert "Subscript" in error
+
+    def test_block_chained_call(self):
+        """Test that calls on method results are blocked."""
+        expr = "config.get('fn')()"
+        valid, error = validate_expression(expr)
+        assert valid is False
+        assert "Call" in error
+
 
 class TestSafeExecute:
     """Test safe execution of expressions."""