rohitg00/ai-engineering-from-scratch · error · ImportError

denied module

Error message

denied module: %s

What it means

The sandboxed runner replaces builtins.__import__ so candidate code cannot import dangerous modules (subprocess, socket, shutil, requests, urllib, ctypes, http.client, and their submodules); this ImportError is raised inside the candidate's own import statement when it requests a blocked module or any submodule whose root name is blocked.

Solutions

1. Rewrite the candidate solution to use only allowed stdlib modules (e.g. use math and collections instead of subprocess)
2. Treat this failure as a scored security violation in the eval, not as a crash: catch ImportError and mark the assertion set as failed
3. Extend _DENIED_MODULES deliberately if the harness should block more surfaces

When it happens

Trigger: Thrown at phases/19-capstone-projects/72-code-exec-metric/code/main.py:78 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of rohitg00/ai-engineering-from-scratch@39ea8a1c6d (2026-08-26). Data as JSON: /api/errors/828c3b85b09879dd. Report an issue: GitHub.

Appendix: source

Thrown at phases/19-capstone-projects/72-code-exec-metric/code/main.py:78

            "per_assertion": list(self.per_assertion),
        }


RUNNER_TEMPLATE = r"""
import json, sys, traceback
import builtins as _builtins

_DENIED_MODULES = {
    'subprocess', 'socket', 'shutil', 'requests', 'urllib',
    'urllib.request', 'urllib.error', 'urllib.parse', 'ctypes',
    'http.client', 'asyncio.subprocess',
}

_real_import = _builtins.__import__
def _guarded_import(name, *args, **kwargs):
    base = name.split('.')[0]
    if name in _DENIED_MODULES or base in _DENIED_MODULES:
        raise ImportError("denied module: %s" % name)
    return _real_import(name, *args, **kwargs)
_builtins.__import__ = _guarded_import

import os as _os
def _denied_system(_cmd):
    raise OSError("os.system denied")
_os.system = _denied_system

CODE = __PLACEHOLDER_CODE__
ASSERTIONS = __PLACEHOLDER_ASSERTIONS__

ns = {}
status = {"exit_code": "pass", "results": [], "detail": ""}
try:
    compiled = compile(CODE, "<candidate>", "exec")
except SyntaxError as exc:
    status["exit_code"] = "syntax_error"
    status["detail"] = "SyntaxError: %s" % exc

View on GitHub (pinned to 39ea8a1c6d)