moo.core.tests.test_security_sandbox_relations

Security tests: sandbox traversal across Django relations.

These cover attack paths where verb code starts with a legitimate MOO Object and then walks Django reverse relations or foreign keys into raw auth, site, mail, or parser metadata rows.

Functions

create_player_avatar(owner, name, username)

Create a MOO Object plus Django auth Player row outside the sandbox.

make_user_key(user)

Create a UserKey row outside the sandbox.

run_in_sandbox(src, caller[, player, ...])

Execute verb source with the same restricted globals used by verbs.

test_comprehension_yields_are_guarded_for_non_wizard(...)

Comprehensions iterate via _getiter_ too; yields must be guarded.

test_iteration_of_sandbox_objects_still_allowed(...)

Looping over readable MOO Objects keeps working.

test_iteration_yields_are_guarded_for_non_wizard(...)

A plain list of restricted model rows must not yield instances to a loop.

test_mail_reverse_relations_are_not_exposed(...)

received_messages/sent_messages must not expose raw mail ORM rows.

test_mailbox_sdk_is_bound_to_active_player(...)

A non-wizard player cannot read another player's mailbox via get_mailbox().

test_object_read_denial_blocks_fields_and_relations(...)

Object.name and relation managers must honor the object's read ACL.

test_parser_metadata_save_requires_wizard(...)

PrepositionSpecifier rows reachable from a Verb cannot be changed by non-wizards.

test_player_reverse_relation_cannot_escalate_to_wizard(...)

A player-owned verb cannot reach Player/User rows through avatar.player_set.

test_print_redacts_restricted_model_instances(...)

print() of a restricted model instance must not leak its __str__.

test_print_shows_restricted_model_to_wizard(...)

Wizards see the real str() of non-sandbox model instances.

test_send_message_cannot_spoof_sender_for_non_wizard_player(...)

send_message() binds non-wizard sends to context.player.

test_site_foreign_key_is_not_exposed_to_non_wizard_verbs(...)

Object.site must not hand a mutable django.contrib.sites Site to verb code.

test_unsafe_model_instances_are_blocked_even_when_in_globals(...)

A raw UserKey passed into globals cannot be inspected or mutated by sandbox code.

test_verb_code_read_denial_blocks_source(...)

Verb.code must honor the verb's read ACL.

test_wizard_can_iterate_restricted_instances(...)

Wizards keep raw access to non-sandbox model rows.