Allow setting env variables dynamically and remove command restrictions (#22)

* Bump containers package version

* Remove rudimentary dangerous commands check

* Allow dynamically setting env vars

* Add changeset

Author: ghostwriternr

.changeset/thin-plums-hammer.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/sandbox": patch
+---
+
+Allow setting env variables dynamically and remove command restrictions

package-lock.json

@@ -400,34 +400,6 @@ async function handleExecuteRequest(
       );
     }
 
-    // Basic safety check - prevent dangerous commands
-    const dangerousCommands = [
-      "rm",
-      "rmdir",
-      "del",
-      "format",
-      "shutdown",
-      "reboot",
-    ];
-    const lowerCommand = command.toLowerCase();
-
-    if (
-      dangerousCommands.some((dangerous) => lowerCommand.includes(dangerous))
-    ) {
-      return new Response(
-        JSON.stringify({
-          error: "Dangerous command not allowed",
-        }),
-        {
-          headers: {
-            "Content-Type": "application/json",
-            ...corsHeaders,
-          },
-          status: 400,
-        }
-      );
-    }
-
     console.log(`[Server] Executing command: ${command} ${args.join(" ")}`);
 
     const result = await executeCommand(command, args, sessionId, background);
@@ -490,34 +462,6 @@ async function handleStreamingExecuteRequest(
       );
     }
 
-    // Basic safety check - prevent dangerous commands
-    const dangerousCommands = [
-      "rm",
-      "rmdir",
-      "del",
-      "format",
-      "shutdown",
-      "reboot",
-    ];
-    const lowerCommand = command.toLowerCase();
-
-    if (
-      dangerousCommands.some((dangerous) => lowerCommand.includes(dangerous))
-    ) {
-      return new Response(
-        JSON.stringify({
-          error: "Dangerous command not allowed",
-        }),
-        {
-          headers: {
-            "Content-Type": "application/json",
-            ...corsHeaders,
-          },
-          status: 400,
-        }
-      );
-    }
-
     console.log(
       `[Server] Executing streaming command: ${command} ${args.join(" ")}`
     );

packages/sandbox/container_src/index.ts

@@ -7,7 +7,7 @@
   },
   "description": "A sandboxed environment for running commands",
   "dependencies": {
-    "@cloudflare/containers": "^0.0.23"
+    "@cloudflare/containers": "^0.0.24"
   },
   "tags": [
     "sandbox",

packages/sandbox/package.json

@@ -55,6 +55,12 @@ export class Sandbox<Env = unknown> extends Container<Env> {
     }
   }
 
+  // RPC method to set environment variables
+  async setEnvVars(envVars: Record<string, string>): Promise<void> {
+    this.envVars = { ...this.envVars, ...envVars };
+    console.log(`[Sandbox] Updated environment variables`);
+  }
+
   override onStart() {
     console.log("Sandbox successfully started");
   }