Build a `!pip install` line for any deps the user listed. Empty if none. We don't whitelist or validate package names here: E2B is the trust boundary, and pip installing a malicious package only harms the sandbox itself.
(deps_field: &str)
| 304 | /// We don't whitelist or validate package names here: E2B is the trust boundary, |
| 305 | /// and pip installing a malicious package only harms the sandbox itself. |
| 306 | fn pip_install_line(deps_field: &str) -> String { |
| 307 | let deps: Vec<&str> = deps_field |
| 308 | .lines() |
| 309 | .map(|l| l.trim()) |
| 310 | .filter(|l| !l.is_empty() && !l.starts_with('#')) |
| 311 | .collect(); |
| 312 | if deps.is_empty() { |
| 313 | return String::new(); |
| 314 | } |
| 315 | format!("!pip install --quiet {}", deps.join(" ")) |
| 316 | } |
| 317 | |
| 318 | /// Hoist `from X import *` lines from module scope (column 0) to the top of the |
| 319 | /// generated script, because Python 3 disallows them inside functions and we |
no test coverage detected