check actual script imports against list of allowed imports (fixing RCE reported against oai_chat)

code_exec.py

@@ -52,7 +52,7 @@ def eval_restricted_script(script):
         
         # Define allowed imports
         '__allowed_modules__': ['math', 'datetime'],
-        '__import__': __import__,
+        '__import__': safe_import,
         
         # Basic functions
         'len': len,
@@ -122,6 +122,12 @@ def _default_write_(obj):
     
     return obj
 
+def safe_import(name, globals=None, locals=None, fromlist=(), level=0):
+    allowed = ['math', 'datetime']
+    if name not in allowed:
+        raise ImportError(f"Import of module '{name}' is not allowed")
+    return __import__(name, globals, locals, fromlist, level)
+
 """ 
 Borrowed implementation of _inplacevar_ from the Zope Foundations's AccessControl module
 https://github.com/zopefoundation/AccessControl/blob/f9ae58816f0712eb6ea97459b4ccafbf4662d9db/src/AccessControl/ZopeGuards.py#L530