From c32f03aee6387dad33bbd07366cffa59ab8194ff Mon Sep 17 00:00:00 2001
From: Alexander Do <alexander.do@helindata.com>
Date: Wed, 28 Oct 2026 15:20:39 +0100
Subject: [PATCH 1/3] disable os acces

---
 .ci/compose/entrypoint.sh |  17 +++
 .ci/deb/Dockerfile        | 103 ++++++++++++++
 .ci/deb/test.sh           |  18 +++
 .dockerignore             |   6 +
 README.rst                |  43 ++++++
 docker-compose.yml        |  50 +++++++
 examples/scale35.py       |  26 ++--
 include/python35.h        |   4 +
 include/script_sandbox.h  | 211 +++++++++++++++++++++++++++
 python35_filter.cpp       | 180 +++++++++++++++++------
 readings35.py             |   1 -
 tests/test_python35.cpp   | 292 ++++++++++++++++++++++++++++++++++++++
 12 files changed, 889 insertions(+), 62 deletions(-)
 create mode 100644 .ci/compose/entrypoint.sh
 create mode 100644 .ci/deb/Dockerfile
 create mode 100644 .ci/deb/test.sh
 create mode 100644 .dockerignore
 create mode 100644 docker-compose.yml
 create mode 100644 include/script_sandbox.h

diff --git a/.ci/compose/entrypoint.sh b/.ci/compose/entrypoint.sh
new file mode 100644
index 0000000..751e862
--- /dev/null
+++ b/.ci/compose/entrypoint.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export FLEDGE_ROOT=/usr/local/fledge
+export FLEDGE_DATA="${FLEDGE_DATA:-/usr/local/fledge/data}"
+
+# Fledge logs to syslog
+rm -f /var/run/rsyslogd.pid
+touch /var/log/syslog
+# Ubuntu's rsyslog drops privileges to the syslog user, Debian's stays root
+chown syslog:adm /var/log/syslog 2>/dev/null || chmod 666 /var/log/syslog
+rsyslogd
+
+"${FLEDGE_ROOT}/bin/fledge" start
+
+# Keep the container in the foreground and show the Fledge logs
+exec tail -F /var/log/syslog
diff --git a/.ci/deb/Dockerfile b/.ci/deb/Dockerfile
new file mode 100644
index 0000000..772b274
--- /dev/null
+++ b/.ci/deb/Dockerfile
@@ -0,0 +1,103 @@
+ARG BASE_IMAGE=ubuntu:22.04
+
+FROM ${BASE_IMAGE} AS deps
+ENV DEBIAN_FRONTEND=noninteractive \
+    TZ=UTC \
+    LANG=C.UTF-8
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        sudo ca-certificates curl wget git unzip dos2unix \
+        build-essential cmake g++ make autoconf automake libtool pkg-config \
+        uuid-dev libssl-dev libz-dev libbz2-dev libreadline-dev liblzma-dev libffi-dev \
+        libboost-dev libboost-system-dev libboost-thread-dev \
+        libpq-dev libcurl4-openssl-dev \
+        python3 python3-dev python3-pip python3-setuptools python3-numpy python3-distutils-extra \
+        sqlite3 \
+        krb5-user \
+        avahi-daemon \
+        dpkg-dev
+
+FROM deps AS builder
+
+WORKDIR /build
+COPY . /build/plugin
+
+RUN find /build/plugin -type f -print0 \
+        | xargs -0 -r dos2unix -q 2>/dev/null || true \
+    && chmod +x /build/plugin/fledge/requirements.sh \
+        /build/plugin/.ci/deb/generate_control.sh \
+        /build/plugin/.ci/deb/package_deb.sh
+
+WORKDIR /build/plugin/fledge
+RUN bash ./requirements.sh
+RUN make -j"$(nproc)"
+
+WORKDIR /build/plugin
+RUN if [ -f requirements.sh ]; then bash ./requirements.sh; fi
+
+ENV FLEDGE_INSTALL=/usr/local/fledge
+ENV LD_LIBRARY_PATH=/usr/local/fledge/lib
+
+WORKDIR /build/plugin
+RUN mkdir -p build && cd build \
+    && cmake -DFLEDGE_SRC=/build/plugin/fledge -DFLEDGE_INSTALL="${FLEDGE_INSTALL}" .. \
+    && make -j"$(nproc)" \
+    && make install
+
+RUN .ci/deb/package_deb.sh "${FLEDGE_INSTALL}" /artifacts
+
+# Run the plugin unit tests (gtest) against the Fledge build above:
+#   docker build -f .ci/deb/Dockerfile --target test .
+FROM builder AS test
+
+RUN apt-get update && apt-get install -y --no-install-recommends libgtest-dev googletest \
+    && rm -rf /var/lib/apt/lists/*
+# Some distros ship the gtest sources only
+RUN if ! ls /usr/lib/*/libgtest.* /usr/lib/libgtest.* >/dev/null 2>&1; then \
+        cmake -S /usr/src/googletest -B /tmp/gtest-build \
+        && cmake --build /tmp/gtest-build -j"$(nproc)" \
+        && cp /tmp/gtest-build/lib/*.a /usr/lib/; \
+    fi
+
+ENV FLEDGE_DATA=/tmp
+ENV LD_LIBRARY_PATH=/build/plugin/fledge/cmake_build/C/lib:/usr/local/fledge/lib
+
+WORKDIR /build/plugin
+# Current gtest releases need C++14, the test CMakeLists pins C++11
+RUN sed -i 's/-std=c++11/-std=c++14/' tests/CMakeLists.txt \
+    && mkdir -p tests-build && cd tests-build \
+    && cmake -DFLEDGE_SRC=/build/plugin/fledge ../tests \
+    && make -j"$(nproc)"
+RUN cd tests-build && ./RunTests
+
+# Runnable Fledge (from the submodule) with this plugin installed, see
+# docker-compose.yml in the repository root.
+FROM builder AS runtime
+
+RUN apt-get update && apt-get install -y --no-install-recommends rsyslog curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && sed -i '/imklog/d' /etc/rsyslog.conf
+
+WORKDIR /build/plugin/fledge
+RUN make install
+
+# South sinusoid plugin, pinned to a tag and verified by commit
+ARG SINUSOID_TAG=v3.1.0
+ARG SINUSOID_COMMIT=4ff6eab5f21671fbcfd244e716572e699d0974da
+RUN git clone --quiet --depth 1 --branch "${SINUSOID_TAG}" \
+        https://github.com/fledge-iot/fledge-south-sinusoid.git /tmp/sinusoid \
+    && test "$(git -C /tmp/sinusoid rev-parse HEAD)" = "${SINUSOID_COMMIT}" \
+    && cp -R /tmp/sinusoid/python/fledge/plugins/south/sinusoid \
+        /usr/local/fledge/python/fledge/plugins/south/ \
+    && rm -rf /tmp/sinusoid
+
+# Taken from the builder stage, where line endings have been normalised
+RUN cp /build/plugin/.ci/compose/entrypoint.sh /usr/local/bin/entrypoint.sh \
+    && chmod +x /usr/local/bin/entrypoint.sh
+
+ENV FLEDGE_ROOT=/usr/local/fledge
+EXPOSE 8081 1995
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+
+FROM scratch AS artifact
+COPY --from=builder /artifacts/ /
diff --git a/.ci/deb/test.sh b/.ci/deb/test.sh
new file mode 100644
index 0000000..fd9a7d3
--- /dev/null
+++ b/.ci/deb/test.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Build Fledge and the plugin in Docker and run the unit tests.
+# Usage: .ci/deb/test.sh [base image] [platform]
+set -euo pipefail
+
+BASE_IMAGE="${1:-ubuntu:24.04}"
+PLATFORM="${2:-linux/amd64}"
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+docker build \
+    --file .ci/deb/Dockerfile \
+    --target test \
+    --platform "$PLATFORM" \
+    --build-arg BASE_IMAGE="$BASE_IMAGE" \
+    --progress=plain \
+    .
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..f9aa168
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+# Keep host build output out of the image
+fledge/cmake_build
+build
+build-out
+tests-build
+__pycache__
diff --git a/README.rst b/README.rst
index 91bd6fb..4216873 100644
--- a/README.rst
+++ b/README.rst
@@ -67,3 +67,46 @@ Examples:
   $ cmake -DFLEDGE_INSTALL=/home/source/develop/Fledge
 
   $ cmake -DFLEDGE_INSTALL=/usr/local/fledge
+
+Script restrictions
+-------------------
+
+Filter scripts (south and north, including those authored through the
+Configurator) run in a restricted environment (PT-HLN-HDP-26A-002, CWE-78).
+The script is checked when the filter starts and on every reconfigure, before
+any of its code runs:
+
+- an AST check rejects imports of anything outside the allow-list, relative
+  and star imports, dunder attribute access (``__class__``, ``__subclasses__``
+  ...), references to ``__import__``/``__builtins__``, and to ``eval``,
+  ``exec``, ``compile``, ``open``, ``getattr`` and similar builtins;
+- the script is then executed with restricted builtins and an ``__import__``
+  that enforces the same allow-list at run time.
+
+A rejected script is logged with the reason and line, the filter stays failed
+and drops readings (fail closed).
+
+Default allow-list: ``json math cmath time datetime re copy collections
+itertools functools string decimal fractions statistics numbers random bisect
+heapq struct base64 binascii hashlib hmac enum typing textwrap unicodedata``.
+Never importable: ``os subprocess socket sys ctypes importlib shutil io
+threading multiprocessing pickle urllib http logging.config`` and others, see
+``include/script_sandbox.h``. Scripts that used ``logging``, ``os`` or ``sys``
+(for example the old ``examples/scale35.py``) must be changed.
+
+**Decision: the allow-list is configurable per deployment, by the operator
+only.** The environment variable ``FLEDGE_PYTHON35_EXTRA_IMPORTS``
+(comma separated exact module names) adds modules to the default list. It is
+read from the Fledge service environment, not from the filter configuration
+category, because that category is editable by the same users who write the
+script. The deny-list can not be overridden. Adding modules widens the attack
+surface, review each one for ways to reach the OS (``logging`` can write
+files, for instance).
+
+This is defence in depth, not a complete sandbox: in-process Python
+restrictions are known to be bypassable by a determined author. Keep running
+Fledge with least privilege and restrict who can edit filter scripts. Checks
+at save time in the Portal/Configurator are a courtesy only; the enforcement
+is here.
+
+Tests: the ``PYTHON35.Sandbox*`` cases in ``tests/test_python35.cpp``.
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..3ea9e77
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,50 @@
+# Fledge built from the ./fledge submodule with this plugin installed.
+#
+#   docker compose up --build    start Fledge (REST API on :8081)
+#   docker compose down -v       stop and remove the data
+#   docker compose --profile test run --build --rm test
+#                                build and run the unit tests (see the test service)
+#
+# The first build compiles all of Fledge and takes a long time.
+# The south sinusoid plugin is installed, add it with:
+#   curl -X POST localhost:8081/fledge/service -d '{"name":"sin","type":"south","plugin":"sinusoid","enabled":true}'
+# The example scripts are mounted read-only at /examples.
+services:
+  fledge:
+    image: fledge-python35:dev
+    build:
+      context: .
+      dockerfile: .ci/deb/Dockerfile
+      target: runtime
+      args:
+        BASE_IMAGE: ${BASE_IMAGE:-ubuntu:24.04}
+    ports:
+      - "8081:8081"
+      - "1995:1995"
+    volumes:
+      - fledge-data:/usr/local/fledge/data
+      - ./examples:/examples:ro
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:8081/fledge/ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 30
+      start_period: 20s
+
+  # Unit tests. Building the image already runs them (the Dockerfile test stage
+  # fails the build if a test fails); running the service runs them again, e.g.
+  #   docker compose --profile test run --rm test --gtest_filter='*Sandbox*'
+  test:
+    image: fledge-python35:test
+    profiles: ["test"]
+    build:
+      context: .
+      dockerfile: .ci/deb/Dockerfile
+      target: test
+      args:
+        BASE_IMAGE: ${BASE_IMAGE:-ubuntu:24.04}
+    working_dir: /build/plugin/tests-build
+    entrypoint: ["./RunTests"]
+
+volumes:
+  fledge-data:
diff --git a/examples/scale35.py b/examples/scale35.py
index f263267..0da4e42 100644
--- a/examples/scale35.py
+++ b/examples/scale35.py
@@ -10,22 +10,18 @@
 __license__ = "Apache 2.0"
 __version__ = "${VERSION}"
 
-import sys
 import json
-import logging
-from logging.handlers import SysLogHandler
-import os
-
-# Log to syslog
-handler = SysLogHandler(address='/dev/log')
-formatter = logging.Formatter(fmt='Fledge[%(process)d] %(levelname)s: %(name)s: %(message)s')
-handler.setFormatter(formatter)
-# When embedded Python is in use sys.argv is not defined,
-logger = logging.getLogger(os.path.basename(__file__))
-
-# Set mininum log severity
-logger.setLevel(logging.DEBUG)
-logger.addHandler(handler)
+
+# Filter scripts run in a restricted environment: os, sys, subprocess, socket,
+# logging and similar modules can not be imported, so diagnostics go to stdout.
+
+
+class _Logger(object):
+    def debug(self, msg):
+        print("DEBUG: " + msg)
+
+
+logger = _Logger()
 
 """
 Filter configuration set by set_filter_config(config)
diff --git a/include/python35.h b/include/python35.h
index a4a5312..cb95012 100644
--- a/include/python35.h
+++ b/include/python35.h
@@ -40,6 +40,7 @@ class Python35Filter : public FledgeFilter
 		{
 			m_pModule = NULL;
 			m_pFunc = NULL;
+			m_sandbox = NULL;
 			m_init = false;
 			m_encode_names = true;
 			m_logger = Logger::getLogger();
@@ -64,6 +65,7 @@ class Python35Filter : public FledgeFilter
 		void	lock() { m_configMutex.lock(); };
 		void	unlock() { m_configMutex.unlock(); };
 		void	logErrorMessage();
+		PyObject*	loadScript(const std::string& scriptName);
 		// Filtering methods for Reading objects
 		PyObject*
 			createReadingsList(const std::vector<Reading *>& readings);
@@ -75,6 +77,8 @@ class Python35Filter : public FledgeFilter
 		PyObject*	m_pModule;
 		// Python 3.5 callable method handle
 		PyObject*	m_pFunc;
+		// Restricted script loader function
+		PyObject*	m_sandbox;
 		// Python 3.5  script name
 		std::string	m_pythonScript;
 		// Python interpreter has been started by this plugin
diff --git a/include/script_sandbox.h b/include/script_sandbox.h
new file mode 100644
index 0000000..15aeb5e
--- /dev/null
+++ b/include/script_sandbox.h
@@ -0,0 +1,211 @@
+#ifndef _SCRIPT_SANDBOX_H
+#define _SCRIPT_SANDBOX_H
+/*
+ * Fledge "Python 3.5" filter: restricted loading of user supplied scripts.
+ *
+ * Released under the Apache 2.0 Licence
+ *
+ * User supplied filter scripts must not be able to import modules such as
+ * os, subprocess, socket, sys or ctypes (CWE-78, PT-HLN-HDP-26A-002).
+ *
+ * Scripts are NOT imported with the normal import machinery. Instead the
+ * source is read, checked with an AST walk, compiled and executed in a fresh
+ * module whose __builtins__ are restricted and whose __import__ only admits
+ * modules on an allow-list.
+ *
+ * The Python source below is run once by the plugin; it defines
+ * load_script(path, name) which returns the module or raises
+ * ScriptSecurityError (an ImportError) with a message that says what was
+ * rejected and where.
+ *
+ * Operators can add modules to the default allow-list with the environment
+ * variable FLEDGE_PYTHON35_EXTRA_IMPORTS (comma separated, exact module
+ * names). The deny-list can not be overridden. The allow-list is deliberately
+ * not part of the filter configuration category, as that is editable by the
+ * same users who author the script.
+ */
+
+#define SCRIPT_SANDBOX_LOADER_FUNCTION "load_script"
+#define SCRIPT_SANDBOX_EXTRA_IMPORTS_ENV "FLEDGE_PYTHON35_EXTRA_IMPORTS"
+
+static const char *SCRIPT_SANDBOX_SOURCE = R"PYSANDBOX(
+import ast
+import builtins as _builtins
+import types as _types
+
+# Modules that can never be imported, nor referenced as an attribute
+DENIED_MODULES = frozenset([
+    'os', 'posix', 'nt', 'subprocess', 'socket', 'socketserver', 'ssl',
+    'sys', 'ctypes', '_ctypes', 'cffi', 'importlib', 'imp', 'runpy', 'pkgutil',
+    'zipimport', 'builtins', '__builtin__', 'shutil', 'pty', 'pexpect',
+    'multiprocessing', 'threading', '_thread', 'signal', 'resource', 'fcntl',
+    'mmap', 'pickle', 'cPickle', 'marshal', 'shelve', 'code', 'codeop',
+    'gc', 'inspect', 'platform', 'pathlib', 'tempfile', 'glob', 'fnmatch',
+    'io', 'urllib', 'http', 'ftplib', 'telnetlib', 'smtplib', 'xmlrpc',
+    'asyncio', 'select', 'selectors', 'webbrowser', 'pdb', 'trace',
+    'sysconfig', 'site', 'distutils', 'setuptools', 'pip', 'posixpath',
+    'ntpath', 'logging.config',
+])
+
+# Modules a filter script may import by default (exact names)
+DEFAULT_ALLOWED_MODULES = frozenset([
+    'json', 'math', 'cmath', 'time', 'datetime', 're', 'copy', 'collections',
+    'itertools', 'functools', 'string', 'decimal', 'fractions', 'statistics',
+    'numbers', 'random', 'bisect', 'heapq', 'struct', 'base64', 'binascii',
+    'hashlib', 'hmac', 'enum', 'typing', 'textwrap', 'unicodedata',
+])
+
+# Builtins that are made available to scripts
+SAFE_BUILTIN_NAMES = (
+    'abs', 'all', 'any', 'ascii', 'bin', 'bool', 'bytearray', 'bytes',
+    'callable', 'chr', 'classmethod', 'complex', 'dict', 'divmod',
+    'enumerate', 'filter', 'float', 'format', 'frozenset', 'hasattr', 'hash',
+    'hex', 'id', 'int', 'isinstance', 'issubclass', 'iter', 'len', 'list',
+    'map', 'max', 'min', 'next', 'object', 'oct', 'ord', 'pow', 'print',
+    'property', 'range', 'repr', 'reversed', 'round', 'set', 'slice',
+    'sorted', 'staticmethod', 'str', 'sum', 'super', 'tuple', 'type', 'zip',
+    'NotImplemented', 'Ellipsis', 'True', 'False', 'None',
+    '__build_class__',
+    # exceptions
+    'BaseException', 'Exception', 'ArithmeticError', 'AssertionError',
+    'AttributeError', 'IndexError', 'KeyError', 'LookupError', 'NameError',
+    'NotImplementedError', 'OverflowError', 'RuntimeError', 'StopIteration',
+    'TypeError', 'UnicodeError', 'ValueError', 'ZeroDivisionError',
+    'ImportError', 'ModuleNotFoundError',
+)
+
+# Builtins that are rejected with a clear message when a script refers to them
+BLOCKED_BUILTIN_NAMES = frozenset([
+    'eval', 'exec', 'compile', 'open', 'input', 'breakpoint', 'getattr',
+    'setattr', 'delattr', 'globals', 'locals', 'vars', 'dir', 'memoryview',
+    'exit', 'quit', 'help', 'license', 'copyright', 'credits',
+])
+
+# Dunder names a script may read
+ALLOWED_DUNDER_NAMES = frozenset(['__name__', '__file__', '__doc__'])
+
+
+class ScriptSecurityError(ImportError):
+    """A script uses something that is not permitted in a filter script"""
+
+
+def _extra_allowed(extra):
+    names = set(n.strip() for n in (extra or '').split(',') if n.strip())
+    return frozenset(n for n in names if n.split('.')[0] not in DENIED_MODULES
+                     and n not in DENIED_MODULES)
+
+
+def allowed_modules(extra=None):
+    return DEFAULT_ALLOWED_MODULES | _extra_allowed(extra)
+
+
+def _is_denied(name):
+    return name in DENIED_MODULES or name.split('.')[0] in DENIED_MODULES
+
+
+def _import_error(name):
+    return ScriptSecurityError(
+        "import of module '%s' is not permitted in a filter script" % name)
+
+
+class _Checker(ast.NodeVisitor):
+    def __init__(self, allowed, filename):
+        self.allowed = allowed
+        self.filename = filename
+
+    def fail(self, node, msg):
+        err = ScriptSecurityError(msg)
+        err.lineno = getattr(node, 'lineno', None)
+        raise err
+
+    def visit_Import(self, node):
+        for alias in node.names:
+            if _is_denied(alias.name) or alias.name not in self.allowed:
+                self.fail(node, "import of module '%s' is not permitted in a "
+                          "filter script (line %s)" % (alias.name, node.lineno))
+
+    def visit_ImportFrom(self, node):
+        if node.level or not node.module:
+            self.fail(node, "relative imports are not permitted in a filter "
+                      "script (line %s)" % node.lineno)
+        if _is_denied(node.module) or node.module not in self.allowed:
+            self.fail(node, "import of module '%s' is not permitted in a "
+                      "filter script (line %s)" % (node.module, node.lineno))
+        for alias in node.names:
+            if alias.name == '*' or _is_denied(alias.name):
+                self.fail(node, "import of '%s' from '%s' is not permitted in a "
+                          "filter script (line %s)" %
+                          (alias.name, node.module, node.lineno))
+
+    def visit_Attribute(self, node):
+        attr = node.attr
+        if attr.startswith('__') and attr.endswith('__'):
+            self.fail(node, "access to attribute '%s' is not permitted in a "
+                      "filter script (line %s)" % (attr, node.lineno))
+        if attr in DENIED_MODULES:
+            self.fail(node, "access to '%s' is not permitted in a filter "
+                      "script (line %s)" % (attr, node.lineno))
+        self.generic_visit(node)
+
+    def visit_Name(self, node):
+        name = node.id
+        if isinstance(node.ctx, ast.Load) and name in BLOCKED_BUILTIN_NAMES:
+            self.fail(node, "use of '%s' is not permitted in a filter "
+                      "script (line %s)" % (name, node.lineno))
+        if isinstance(node.ctx, ast.Load) and name.startswith('__') \
+                and name.endswith('__') and name not in ALLOWED_DUNDER_NAMES:
+            self.fail(node, "use of name '%s' is not permitted in a filter "
+                      "script (line %s)" % (name, node.lineno))
+        self.generic_visit(node)
+
+
+def check_source(source, filename='<script>', allowed=None):
+    """Parse source and reject anything not permitted. Returns the code object"""
+    if allowed is None:
+        allowed = allowed_modules()
+    tree = ast.parse(source, filename)
+    _Checker(allowed, filename).visit(tree)
+    return compile(tree, filename, 'exec')
+
+
+def _make_import(allowed):
+    real_import = _builtins.__import__
+
+    def restricted_import(name, globals=None, locals=None, fromlist=(), level=0):
+        if level != 0 or _is_denied(name) or name not in allowed:
+            raise _import_error(name)
+        module = real_import(name, globals, locals, fromlist, 0)
+        # "from pkg import submodule" imports a module that is not on the list
+        for item in (fromlist or ()):
+            sub = getattr(module, item, None)
+            if isinstance(sub, _types.ModuleType) and sub.__name__ not in allowed:
+                raise _import_error(sub.__name__)
+        return module
+
+    return restricted_import
+
+
+def _restricted_builtins(allowed):
+    safe = {}
+    for name in SAFE_BUILTIN_NAMES:
+        safe[name] = getattr(_builtins, name)
+    safe['__import__'] = _make_import(allowed)
+    return safe
+
+
+def load_script(path, name, extra_imports=None):
+    """Load the script at path as a module called name, in a restricted
+    environment. extra_imports is the operator supplied, comma separated,
+    list of additional modules"""
+    allowed = allowed_modules(extra_imports)
+    with _builtins.open(path, 'rb') as f:
+        source = f.read()
+    code = check_source(source, path, allowed)
+    module = _types.ModuleType(name)
+    module.__file__ = path
+    module.__dict__['__builtins__'] = _restricted_builtins(allowed)
+    exec(code, module.__dict__)
+    return module
+)PYSANDBOX";
+
+#endif
diff --git a/python35_filter.cpp b/python35_filter.cpp
index 9057a90..5f48aa3 100644
--- a/python35_filter.cpp
+++ b/python35_filter.cpp
@@ -24,6 +24,7 @@
 #define DEFAULT_FILTER_CONFIG_METHOD "set_filter_config"
 
 #include "python35.h"
+#include "script_sandbox.h"
 
 using namespace std;
 
@@ -239,6 +240,9 @@ void Python35Filter::shutdown()
 	// Decrement pModule reference count
 	Py_CLEAR(m_pModule);
 
+	// Decrement sandbox loader reference count
+	Py_CLEAR(m_sandbox);
+
 	m_init = false;
 
 	// Interpreter is still running, just release the GIL
@@ -363,6 +367,76 @@ vector<Reading *>* Python35Filter::getFilteredReadings(PyObject* filteredData)
 
 }
 
+/**
+ * Load a user supplied script as a module in a restricted environment.
+ *
+ * The script source is checked (AST import check) and run with restricted
+ * builtins, see script_sandbox.h. Replaces PyImport_ImportModule, which would
+ * run the script with no restrictions at all.
+ *
+ * The GIL must be held by the caller.
+ *
+ * @param scriptName	Script module name, without path or .py extension
+ * @return		New reference to the module or NULL with the Python
+ *			error indicator set
+ */
+PyObject* Python35Filter::loadScript(const string& scriptName)
+{
+	if (!m_sandbox)
+	{
+		PyObject* ns = PyDict_New();
+		PyObject* res = PyRun_String(SCRIPT_SANDBOX_SOURCE, Py_file_input, ns, ns);
+		if (!res)
+		{
+			Py_CLEAR(ns);
+			return NULL;
+		}
+		Py_CLEAR(res);
+		m_sandbox = PyDict_GetItemString(ns, SCRIPT_SANDBOX_LOADER_FUNCTION);
+		Py_XINCREF(m_sandbox);
+		Py_CLEAR(ns);
+		if (!m_sandbox)
+		{
+			PyErr_SetString(PyExc_RuntimeError, "Script sandbox loader is not available");
+			return NULL;
+		}
+	}
+
+	// The script name must be a plain file name: no path components
+	if (scriptName.empty() || scriptName.find('/') != string::npos ||
+	    scriptName.find("..") != string::npos)
+	{
+		PyErr_SetString(PyExc_ImportError, "Invalid filter script name");
+		return NULL;
+	}
+	string path = m_filtersPath + "/" + scriptName + PYTHON_SCRIPT_FILENAME_EXTENSION;
+	// Additional modules, set by the operator in the Fledge environment
+	const char *extra = getenv(SCRIPT_SANDBOX_EXTRA_IMPORTS_ENV);
+	return PyObject_CallFunction(m_sandbox, (char *)"sss", path.c_str(), scriptName.c_str(),
+				     extra ? extra : "");
+}
+
+/**
+ * Return the UTF-8 string value of a Python object. The reference is borrowed.
+ * Returns an empty string if the object is NULL or can not be converted.
+ */
+static std::string pyString(PyObject *obj)
+{
+	std::string result;
+	if (obj)
+	{
+		PyObject *str = PyObject_Str(obj);
+		const char *utf8 = str ? PyUnicode_AsUTF8(str) : NULL;
+		if (utf8)
+		{
+			result = utf8;
+		}
+		Py_XDECREF(str);
+	}
+	PyErr_Clear();
+	return result;
+}
+
 /**
  * Log an error from the Python interpreter
  */
@@ -375,65 +449,79 @@ PyObject *ptype, *pvalue, *ptraceback;
 		PyErr_Fetch(&ptype, &pvalue, &ptraceback);
 		PyErr_NormalizeException(&ptype,&pvalue,&ptraceback);
 
-		char *msg, *file, *text;
-		int line, offset;
-
-		int res = PyArg_ParseTuple(pvalue,"s(siis)",&msg,&file,&line,&offset,&text);
-
-		PyObject *line_no = PyObject_GetAttrString(pvalue,"lineno");
-		PyObject *line_no_str = PyObject_Str(line_no);
-		PyObject *line_no_unicode = PyUnicode_AsEncodedString(line_no_str,"utf-8", "Error");
-		char *actual_line_no = PyBytes_AsString(line_no_unicode);  // Line number
-
-		PyObject *ptext = PyObject_GetAttrString(pvalue,"text");
-		PyObject *ptext_str = PyObject_Str(ptext);
-		PyObject *ptext_no_unicode = PyUnicode_AsEncodedString(ptext_str,"utf-8", "Error");
-		char *error_line = PyBytes_AsString(ptext_no_unicode);  // Line in error
-
-		// Remove the trailing newline from the string
-		char *newline = rindex(error_line,  '\n');
-		if (newline)
+		// Import errors, including scripts rejected by the sandbox, carry
+		// a self explanatory message
+		if (PyErr_GivenExceptionMatches(ptype, PyExc_ImportError))
 		{
-			*newline = '\0';
+			std::string imsg = pyString(pvalue);
+			m_logger->error("Python script rejected or failed to load: %s",
+					imsg.empty() ? "unknown import error" : imsg.c_str());
+			Py_XDECREF(ptype);
+			Py_XDECREF(pvalue);
+			Py_XDECREF(ptraceback);
+			return;
 		}
 
-		// Not managed to find a way to get the actual error message from Python
-		// so use the string representation of the Error class and tidy it up, e.g.
-		// SyntaxError('invalid syntax', ('/tmp/scripts/test_addition_script_script.py', 9, 1, '}\n'))
-		PyObject *pstr = PyObject_Repr(pvalue);
-		PyObject *perr = PyUnicode_AsEncodedString(pstr, "utf-8", "Error");
-		char *err_msg = PyBytes_AsString(perr);
-		char *end = index(err_msg, ',');
-		if (end)
+		// Error type and message, e.g. IndentationError: expected an indented block
+		std::string errType;
+		PyObject *ptypeName = ptype ? PyObject_GetAttrString(ptype, "__name__") : NULL;
+		errType = pyString(ptypeName);
+		Py_XDECREF(ptypeName);
+		std::string errMsg;
+		PyObject *pmsg = pvalue ? PyObject_GetAttrString(pvalue, "msg") : NULL;
+		if (pmsg)
 		{
-			*end = '\0';
+			errMsg = pyString(pmsg);
+			Py_DECREF(pmsg);
 		}
-		end = index(err_msg, '(');
-		if (end)
+		else
 		{
-			*end = ' ';
+			PyErr_Clear();
+			errMsg = pyString(pvalue);
 		}
+		std::string err_msg = errType.empty() ? errMsg : errType + " " + errMsg;
 
+		// SyntaxError carries the line number and text, other exceptions do not
+		std::string actual_line_no;
+		std::string error_line;
+		if (pvalue)
+		{
+			PyObject *line_no = PyObject_GetAttrString(pvalue, "lineno");
+			if (line_no && line_no != Py_None)
+			{
+				actual_line_no = pyString(line_no);
+			}
+			Py_XDECREF(line_no);
+			PyErr_Clear();
+
+			PyObject *ptext = PyObject_GetAttrString(pvalue, "text");
+			if (ptext && ptext != Py_None)
+			{
+				error_line = pyString(ptext);
+				// Remove the trailing newline from the string
+				while (!error_line.empty() && (error_line.back() == '\n' || error_line.back() == '\r'))
+				{
+					error_line.pop_back();
+				}
+			}
+			Py_XDECREF(ptext);
+			PyErr_Clear();
+		}
 
-		if (error_line == NULL || actual_line_no == NULL || strcmp(error_line, "<NULL>") == 0
-			       	|| strcmp(actual_line_no, "<NULL>") == 0)
+		if (error_line.empty() || actual_line_no.empty())
 		{
-			m_logger->error("Python error: %s in supplied script", err_msg);
+			m_logger->error("Python error: %s in supplied script", err_msg.c_str());
 		}
 		else
 		{
-			m_logger->error("Python error: %s in %s at line %s of supplied script", err_msg, error_line, actual_line_no);
+			m_logger->error("Python error: %s in %s at line %s of supplied script",
+					err_msg.c_str(), error_line.c_str(), actual_line_no.c_str());
 		}
 
 		PyErr_Clear();
-		Py_CLEAR(line_no);
-		Py_CLEAR(line_no_str);
-		Py_CLEAR(line_no_unicode);
-		Py_CLEAR(ptext);
-		Py_CLEAR(ptext_str);
-		Py_CLEAR(ptext_no_unicode);
-		Py_CLEAR(pstr);
-		Py_CLEAR(perr);
+		Py_XDECREF(ptype);
+		Py_XDECREF(pvalue);
+		Py_XDECREF(ptraceback);
 	}
 }
 
@@ -511,7 +599,7 @@ bool Python35Filter::reconfigure(const string& newConfig)
 		m_failedScript = false;
 		m_execCount = 0;
 		// Reimport module
-		PyObject* newModule = PyImport_ReloadModule(m_pModule);
+		PyObject* newModule = loadScript(newScript);
 		if (newModule)
 		{
 			// Cleanup Loaded module
@@ -556,7 +644,7 @@ bool Python35Filter::reconfigure(const string& newConfig)
 		m_pythonScript = newScript;
 
 		// Import the new module
-		PyObject* newModule = PyImport_ImportModule(m_pythonScript.c_str());
+		PyObject* newModule = loadScript(m_pythonScript);
 
 		// Set reloaded module
 		m_pModule = newModule;
@@ -734,7 +822,7 @@ bool Python35Filter::configure()
 	// 2) Import Python script if module object is not set
 	if (!m_pModule)
 	{
-		m_pModule = PyImport_ImportModule(m_pythonScript.c_str());
+		m_pModule = loadScript(m_pythonScript);
 	}
 
 	// Check whether the Python module has been imported
diff --git a/readings35.py b/readings35.py
index 59226fe..55d0792 100644
--- a/readings35.py
+++ b/readings35.py
@@ -8,7 +8,6 @@
 __license__ = "Apache 2.0"
 __version__ = "${VERSION}"
 
-import sys
 import json
 
 """
diff --git a/tests/test_python35.cpp b/tests/test_python35.cpp
index f1eaee9..3dac4f2 100644
--- a/tests/test_python35.cpp
+++ b/tests/test_python35.cpp
@@ -6,6 +6,8 @@
 #include <string.h>
 #include <stdlib.h>
 #include <string>
+#include <fstream>
+#include <sstream>
 #include <rapidjson/document.h>
 #include <reading.h>
 #include <reading_set.h>
@@ -63,6 +65,59 @@ def script(readings):
     return readings
 )";
 
+const char *poc_os_script = R"(
+import os
+os.system("curl http://127.0.0.1:9/poc")
+
+def script(readings):
+    return readings
+)";
+
+const char *subprocess_script = R"(
+import subprocess
+
+def script(readings):
+    subprocess.call(["id"])
+    return readings
+)";
+
+const char *from_os_script = R"(
+from os import system
+
+def script(readings):
+    return readings
+)";
+
+const char *sys_script = R"(
+import sys
+
+def script(readings):
+    return readings
+)";
+
+const char *dunder_import_script = R"(
+def script(readings):
+    __import__("os").system("id")
+    return readings
+)";
+
+const char *rename_script = R"(
+def script(readings):
+    for elem in readings:
+        elem['asset_code'] = 'renamed_' + elem['asset_code']
+    return readings
+)";
+
+const char *scale_script = R"(
+import json
+
+def script(readings):
+    for elem in list(readings):
+        reading = elem['reading']
+        reading[b'a'] = reading[b'a'] * 2 + 10
+    return readings
+)";
+
 extern "C" {
 	PLUGIN_INFORMATION *plugin_info();
 	void plugin_ingest(void *handle,
@@ -327,6 +382,243 @@ TEST(PYTHON35, IndentError)
 	plugin_shutdown(handle);
 }
 
+/*
+ * Create a filter for the given script content, returns the handle.
+ * The handle is not initialised successfully if the script is rejected.
+ */
+static void *initScript(const char *name, const char *content, ConfigCategory **config,
+			ReadingSet **outReadings, bool encodeNames = true,
+			const char *method = "script")
+{
+	setenv("FLEDGE_DATA", "/tmp", 1);
+	mkdir("/tmp/scripts", 0777);
+
+	PLUGIN_INFORMATION *info = plugin_info();
+	*config = new ConfigCategory("script", info->config);
+	(*config)->setItemsValueFromDefault();
+	string script = string("/tmp/scripts/") + name + "_script_" + method + ".py";
+	FILE *fp = fopen(script.c_str(), "w");
+	EXPECT_NE(fp, (FILE *)0);
+	fprintf(fp, "%s", content);
+	fclose(fp);
+	(*config)->setValue("script", content);
+	(*config)->setItemAttribute("script", ConfigCategory::FILE_ATTR, script);
+	(*config)->setValue("enable", "true");
+	if (!encodeNames)
+	{
+		(*config)->setValue("encode_attribute_names", "false");
+	}
+	*outReadings = NULL;
+	return plugin_init(*config, outReadings, Handler);
+}
+
+static void expectRejected(const char *name, const char *content)
+{
+	ConfigCategory *config;
+	ReadingSet *outReadings;
+	void *handle = initScript(name, content, &config, &outReadings);
+	Python35Filter *hndl = (Python35Filter *) handle;
+	// The script has been refused: the filter must not be usable
+	ASSERT_FALSE(hndl && hndl->initSuccess());
+
+	// And no data may flow through it
+	vector<Reading *> *readings = new vector<Reading *>;
+	vector<Datapoint *> datapoints;
+	long a = 1;
+	DatapointValue dpv(a);
+	datapoints.push_back(new Datapoint("a", dpv));
+	readings->push_back(new Reading("test", datapoints));
+	ReadingSet *readingSet = new ReadingSet(readings);
+	delete readings;
+	plugin_ingest(handle, (READINGSET *)readingSet);
+	ASSERT_EQ(outReadings, (ReadingSet *)NULL);
+
+	delete config;
+	plugin_shutdown(handle);
+}
+
+/**
+ * Regression test for PT-HLN-HDP-26A-002: os.system() from a filter script
+ */
+TEST(PYTHON35, SandboxRejectsOsSystem)
+{
+	expectRejected("test_poc_os", poc_os_script);
+}
+
+TEST(PYTHON35, SandboxRejectsFromOsImport)
+{
+	expectRejected("test_from_os", from_os_script);
+}
+
+TEST(PYTHON35, SandboxRejectsSubprocess)
+{
+	expectRejected("test_subprocess", subprocess_script);
+}
+
+TEST(PYTHON35, SandboxRejectsSys)
+{
+	expectRejected("test_sys", sys_script);
+}
+
+TEST(PYTHON35, SandboxRejectsDunderImport)
+{
+	expectRejected("test_dunder_import", dunder_import_script);
+}
+
+TEST(PYTHON35, SandboxAllowsAssetRename)
+{
+	ConfigCategory *config;
+	ReadingSet *outReadings;
+	void *handle = initScript("test_rename", rename_script, &config, &outReadings, false);
+	ASSERT_NE(handle, (void *)NULL);
+
+	vector<Reading *> *readings = new vector<Reading *>;
+	vector<Datapoint *> datapoints;
+	long a = 1;
+	DatapointValue dpv(a);
+	datapoints.push_back(new Datapoint("a", dpv));
+	readings->push_back(new Reading("test", datapoints));
+	ReadingSet *readingSet = new ReadingSet(readings);
+	delete readings;
+	plugin_ingest(handle, (READINGSET *)readingSet);
+
+	ASSERT_NE(outReadings, (ReadingSet *)NULL);
+	vector<Reading *> results = outReadings->getAllReadings();
+	ASSERT_EQ(results.size(), 1);
+	ASSERT_STREQ(results[0]->getAssetName().c_str(), "renamed_test");
+
+	delete config;
+	delete outReadings;
+	plugin_shutdown(handle);
+}
+
+TEST(PYTHON35, SandboxAllowsScaling)
+{
+	ConfigCategory *config;
+	ReadingSet *outReadings;
+	void *handle = initScript("test_scale", scale_script, &config, &outReadings);
+	ASSERT_NE(handle, (void *)NULL);
+
+	vector<Reading *> *readings = new vector<Reading *>;
+	vector<Datapoint *> datapoints;
+	long a = 100;
+	DatapointValue dpv(a);
+	datapoints.push_back(new Datapoint("a", dpv));
+	readings->push_back(new Reading("test", datapoints));
+	ReadingSet *readingSet = new ReadingSet(readings);
+	delete readings;
+	plugin_ingest(handle, (READINGSET *)readingSet);
+
+	ASSERT_NE(outReadings, (ReadingSet *)NULL);
+	vector<Reading *> results = outReadings->getAllReadings();
+	ASSERT_EQ(results.size(), 1);
+	vector<Datapoint *> points = results[0]->getReadingData();
+	ASSERT_EQ(points.size(), 1);
+	ASSERT_EQ(points[0]->getData().toInt(), 210);
+
+	delete config;
+	delete outReadings;
+	plugin_shutdown(handle);
+}
+
+/**
+ * Other ways a filter script could reach the OS or the interpreter internals
+ */
+TEST(PYTHON35, SandboxRejectsOtherEscapes)
+{
+	struct { const char *name; const char *script; } cases[] = {
+		{ "test_esc_ctypes", "import ctypes\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_socket", "import socket\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_importlib", "import importlib\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_unlisted", "import xml\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_function", "def script(readings):\n    import os\n    return readings\n" },
+		{ "test_esc_relative", "from . import x\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_star", "from json import *\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_submodule", "from json import tool\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_attr", "import json\njson.os.system('id')\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_class", "x = ().__class__.__bases__[0].__subclasses__()\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_builtins", "x = __builtins__\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_eval", "eval('1')\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_exec", "exec('import os')\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_open", "open('/etc/passwd')\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_getattr", "getattr(1, 'real')\ndef script(readings):\n    return readings\n" },
+	};
+	for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); i++)
+	{
+		SCOPED_TRACE(cases[i].name);
+		expectRejected(cases[i].name, cases[i].script);
+	}
+}
+
+/**
+ * The operator can extend the allow-list from the environment, but can not
+ * override the deny-list
+ */
+TEST(PYTHON35, SandboxExtraImportsFromEnvironment)
+{
+	const char *xml_script = "import xml\ndef script(readings):\n    return readings\n";
+	const char *os_script = "import os\ndef script(readings):\n    return readings\n";
+
+	setenv("FLEDGE_PYTHON35_EXTRA_IMPORTS", "xml,os", 1);
+
+	ConfigCategory *config;
+	ReadingSet *outReadings;
+	void *handle = initScript("test_extra_xml", xml_script, &config, &outReadings);
+	ASSERT_NE(handle, (void *)NULL);
+	ASSERT_TRUE(((Python35Filter *)handle)->initSuccess());
+	delete config;
+	plugin_shutdown(handle);
+
+	// os is on the deny-list, so listing it in the environment has no effect
+	expectRejected("test_extra_os", os_script);
+
+	unsetenv("FLEDGE_PYTHON35_EXTRA_IMPORTS");
+	// Without the environment variable xml is rejected again
+	expectRejected("test_extra_none", xml_script);
+}
+
+/**
+ * The bundled scaling example must run in the restricted environment
+ */
+TEST(PYTHON35, SandboxAllowsScaleExample)
+{
+	string path = string(__FILE__);
+	path = path.substr(0, path.find_last_of('/')) + "/../examples/scale35.py";
+	ifstream in(path.c_str());
+	ASSERT_TRUE(in.good());
+	stringstream content;
+	content << in.rdbuf();
+
+	ConfigCategory *config;
+	ReadingSet *outReadings;
+	void *handle = initScript("test_scale_example", content.str().c_str(),
+				  &config, &outReadings, true, "scale35");
+	ASSERT_NE(handle, (void *)NULL);
+	ASSERT_TRUE(((Python35Filter *)handle)->initSuccess());
+
+	vector<Reading *> *readings = new vector<Reading *>;
+	vector<Datapoint *> datapoints;
+	long a = 100;
+	DatapointValue dpv(a);
+	datapoints.push_back(new Datapoint("a", dpv));
+	readings->push_back(new Reading("test", datapoints));
+	ReadingSet *readingSet = new ReadingSet(readings);
+	delete readings;
+	plugin_ingest(handle, (READINGSET *)readingSet);
+
+	ASSERT_NE(outReadings, (ReadingSet *)NULL);
+	vector<Reading *> results = outReadings->getAllReadings();
+	ASSERT_EQ(results.size(), 1);
+	vector<Datapoint *> points = results[0]->getReadingData();
+	ASSERT_EQ(points.size(), 1);
+	// Default scale 5 and offset 10
+	ASSERT_EQ(points[0]->getData().toInt(), 510);
+
+	delete config;
+	delete outReadings;
+	plugin_shutdown(handle);
+}
+
 #if 0
 Currently this can not be run because of an issue with getting a string
 variant of the configuration category. This is not a plugin issue and needs

From 6a1a1c38f2aafde05bc6859f6aac11d62e7a21e6 Mon Sep 17 00:00:00 2001
From: Alexander Do <alexander.do@helindata.com>
Date: Thu, 29 Oct 2026 14:09:04 +0100
Subject: [PATCH 2/3] add more strict blocking of imports

---
 .ci/deb/Dockerfile       | 18 +++++++++---------
 .dockerignore            |  2 +-
 CMakeLists.txt           |  8 ++++----
 README.rst               |  6 +++---
 docker-compose.yml       |  2 +-
 include/script_sandbox.h | 27 +++++++++++++++++++++++++--
 tests/test_python35.cpp  |  5 +++++
 7 files changed, 48 insertions(+), 20 deletions(-)

diff --git a/.ci/deb/Dockerfile b/.ci/deb/Dockerfile
index 772b274..e11b91c 100644
--- a/.ci/deb/Dockerfile
+++ b/.ci/deb/Dockerfile
@@ -23,10 +23,14 @@ WORKDIR /build
 COPY . /build/plugin
 
 RUN find /build/plugin -type f -print0 \
-        | xargs -0 -r dos2unix -q 2>/dev/null || true \
-    && chmod +x /build/plugin/fledge/requirements.sh \
-        /build/plugin/.ci/deb/generate_control.sh \
-        /build/plugin/.ci/deb/package_deb.sh
+        | xargs -0 -r dos2unix -q 2>/dev/null || true
+
+# Fledge core, built from source. It is not part of this repository (there is no
+# submodule), so it is cloned here. Override with --build-arg FLEDGE_REF=<branch|tag>
+ARG FLEDGE_REPO=https://github.com/fledge-iot/fledge.git
+ARG FLEDGE_REF=develop
+RUN git clone --quiet --depth 1 --branch "${FLEDGE_REF}" "${FLEDGE_REPO}" /build/plugin/fledge \
+    && chmod +x /build/plugin/fledge/requirements.sh
 
 WORKDIR /build/plugin/fledge
 RUN bash ./requirements.sh
@@ -44,7 +48,6 @@ RUN mkdir -p build && cd build \
     && make -j"$(nproc)" \
     && make install
 
-RUN .ci/deb/package_deb.sh "${FLEDGE_INSTALL}" /artifacts
 
 # Run the plugin unit tests (gtest) against the Fledge build above:
 #   docker build -f .ci/deb/Dockerfile --target test .
@@ -70,7 +73,7 @@ RUN sed -i 's/-std=c++11/-std=c++14/' tests/CMakeLists.txt \
     && make -j"$(nproc)"
 RUN cd tests-build && ./RunTests
 
-# Runnable Fledge (from the submodule) with this plugin installed, see
+# Runnable Fledge (built from source) with this plugin installed, see
 # docker-compose.yml in the repository root.
 FROM builder AS runtime
 
@@ -98,6 +101,3 @@ RUN cp /build/plugin/.ci/compose/entrypoint.sh /usr/local/bin/entrypoint.sh \
 ENV FLEDGE_ROOT=/usr/local/fledge
 EXPOSE 8081 1995
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
-
-FROM scratch AS artifact
-COPY --from=builder /artifacts/ /
diff --git a/.dockerignore b/.dockerignore
index f9aa168..709e5da 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,5 @@
 # Keep host build output out of the image
-fledge/cmake_build
+fledge
 build
 build-out
 tests-build
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1908386..9a61b06 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -42,12 +42,12 @@ set(NEEDED_FLEDGE_LIBS common-lib plugins-common-lib filters-common-lib services
 # Find source files
 file(GLOB SOURCES *.cpp)
 
-# Find python3.x dev/lib package
+# Find python3.x dev/lib package, 3.8 or later
 find_package(PkgConfig REQUIRED)
 if(${CMAKE_VERSION} VERSION_LESS "3.12.0") 
-    pkg_check_modules(PYTHON REQUIRED python3)
+    pkg_check_modules(PYTHON REQUIRED python3>=3.8)
 else()
-    find_package(Python COMPONENTS Interpreter Development)
+    find_package(Python 3.8 REQUIRED COMPONENTS Interpreter Development)
 endif()
 
 # Find Fledge includes and libs, by including FindFledge.cmak file
@@ -107,7 +107,7 @@ add_library(${PROJECT_NAME} SHARED ${SOURCES} version.h)
 target_link_libraries(${PROJECT_NAME} ${NEEDED_FLEDGE_LIBS})
 
 # Add additional libraries
-# Add Python 3.5 library
+# Add Python library
 if(${CMAKE_VERSION} VERSION_LESS "3.12.0") 
     target_link_libraries(${PROJECT_NAME} ${PYTHON_LIBRARIES})
 else()
diff --git a/README.rst b/README.rst
index 4216873..6f77d51 100644
--- a/README.rst
+++ b/README.rst
@@ -2,11 +2,11 @@
 Fledge "Python35" C++ Filter plugin
 =========================================
 
-A readings data transformation plugin using Python 3.5
-embedded interpreter.
+A readings data transformation plugin using an embedded Python 3
+interpreter. The name is historic, Python 3.8 or later is required.
 
 NOTE:
-Python3.5 development package is required.
+Python 3.8 or later and its development package are required.
 
 Build
 -----
diff --git a/docker-compose.yml b/docker-compose.yml
index 3ea9e77..2e4f5c8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,4 +1,4 @@
-# Fledge built from the ./fledge submodule with this plugin installed.
+# Fledge built from source (cloned during the image build, see FLEDGE_REF in the Dockerfile) with this plugin installed.
 #
 #   docker compose up --build    start Fledge (REST API on :8081)
 #   docker compose down -v       stop and remove the data
diff --git a/include/script_sandbox.h b/include/script_sandbox.h
index 15aeb5e..9401599 100644
--- a/include/script_sandbox.h
+++ b/include/script_sandbox.h
@@ -132,7 +132,11 @@ class _Checker(ast.NodeVisitor):
             self.fail(node, "import of module '%s' is not permitted in a "
                       "filter script (line %s)" % (node.module, node.lineno))
         for alias in node.names:
-            if alias.name == '*' or _is_denied(alias.name):
+            # Dunder names such as json.__builtins__ expose the real builtins,
+            # private names such as random._os expose modules that are denied
+            if (alias.name == '*' or _is_denied(alias.name)
+                    or alias.name in BLOCKED_BUILTIN_NAMES
+                    or alias.name.startswith('_')):
                 self.fail(node, "import of '%s' from '%s' is not permitted in a "
                           "filter script (line %s)" %
                           (alias.name, node.module, node.lineno))
@@ -168,8 +172,24 @@ def check_source(source, filename='<script>', allowed=None):
     return compile(tree, filename, 'exec')
 
 
+def _public_facade(module, allowed):
+    """A copy of module that only has its public names. Private names often
+    refer to modules that are denied, for example random._os, and attribute
+    access does not go through __import__. Modules that are not on the
+    allow-list are left out as well."""
+    facade = _types.ModuleType(module.__name__)
+    for key, value in vars(module).items():
+        if key.startswith('_'):
+            continue
+        if isinstance(value, _types.ModuleType) and value.__name__ not in allowed:
+            continue
+        setattr(facade, key, value)
+    return facade
+
+
 def _make_import(allowed):
     real_import = _builtins.__import__
+    facades = {}
 
     def restricted_import(name, globals=None, locals=None, fromlist=(), level=0):
         if level != 0 or _is_denied(name) or name not in allowed:
@@ -180,7 +200,10 @@ def _make_import(allowed):
             sub = getattr(module, item, None)
             if isinstance(sub, _types.ModuleType) and sub.__name__ not in allowed:
                 raise _import_error(sub.__name__)
-        return module
+        facade = facades.get(module.__name__)
+        if facade is None:
+            facade = facades[module.__name__] = _public_facade(module, allowed)
+        return facade
 
     return restricted_import
 
diff --git a/tests/test_python35.cpp b/tests/test_python35.cpp
index 3dac4f2..89b7570 100644
--- a/tests/test_python35.cpp
+++ b/tests/test_python35.cpp
@@ -538,6 +538,11 @@ TEST(PYTHON35, SandboxRejectsOtherEscapes)
 		{ "test_esc_attr", "import json\njson.os.system('id')\ndef script(readings):\n    return readings\n" },
 		{ "test_esc_class", "x = ().__class__.__bases__[0].__subclasses__()\ndef script(readings):\n    return readings\n" },
 		{ "test_esc_builtins", "x = __builtins__\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_from_builtins", "from json import __builtins__ as b\nb['__import__']('os').system('id')\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_from_dunder", "from json import __loader__\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_private_attr", "import random\nrandom._os.system('id')\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_private_from", "from random import _os\ndef script(readings):\n    return readings\n" },
+		{ "test_esc_from_eval", "from json import eval\ndef script(readings):\n    return readings\n" },
 		{ "test_esc_eval", "eval('1')\ndef script(readings):\n    return readings\n" },
 		{ "test_esc_exec", "exec('import os')\ndef script(readings):\n    return readings\n" },
 		{ "test_esc_open", "open('/etc/passwd')\ndef script(readings):\n    return readings\n" },

From 5f14db393c1837ff6cd452537e294ffa14bad087 Mon Sep 17 00:00:00 2001
From: Alexander Do <alexander.do@helindata.com>
Date: Thu, 29 Oct 2026 14:21:01 +0100
Subject: [PATCH 3/3] fix pipeline

---
 .ci/deb/Dockerfile | 8 ++++++--
 .dockerignore      | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.ci/deb/Dockerfile b/.ci/deb/Dockerfile
index e11b91c..afd56e2 100644
--- a/.ci/deb/Dockerfile
+++ b/.ci/deb/Dockerfile
@@ -26,10 +26,14 @@ RUN find /build/plugin -type f -print0 \
         | xargs -0 -r dos2unix -q 2>/dev/null || true
 
 # Fledge core, built from source. It is not part of this repository (there is no
-# submodule), so it is cloned here. Override with --build-arg FLEDGE_REF=<branch|tag>
+# submodule). If a checkout is already in ./fledge (as in CI) it is used, otherwise
+# it is cloned here. Override with --build-arg FLEDGE_REF=<branch|tag>
 ARG FLEDGE_REPO=https://github.com/fledge-iot/fledge.git
 ARG FLEDGE_REF=develop
-RUN git clone --quiet --depth 1 --branch "${FLEDGE_REF}" "${FLEDGE_REPO}" /build/plugin/fledge \
+RUN if [ ! -f /build/plugin/fledge/requirements.sh ]; then \
+        rm -rf /build/plugin/fledge \
+        && git clone --quiet --depth 1 --branch "${FLEDGE_REF}" "${FLEDGE_REPO}" /build/plugin/fledge; \
+    fi \
     && chmod +x /build/plugin/fledge/requirements.sh
 
 WORKDIR /build/plugin/fledge
diff --git a/.dockerignore b/.dockerignore
index 709e5da..f9aa168 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,5 @@
 # Keep host build output out of the image
-fledge
+fledge/cmake_build
 build
 build-out
 tests-build