Bug 1840533 - Forbid @imports("__builtin__"). r=firefox-build-system-reviewers,andi,sergesanspaille

The last use of importing the whole __builtin__ module was removed in
bug 1264831... 7 years ago.

Now that it actually doesn't work anymore with recent releases of
cpython, we might as well kill it for good.

Differential Revision: https://phabricator.services.mozilla.com/D182140

python/mozbuild/mozbuild/configure/__init__.py

@@ -1087,8 +1087,7 @@ class ConfigureSandbox(dict):
     def _get_one_import(self, _from, _import, _as, glob):
         """Perform the given import, placing the result into the dict glob."""
         if not _from and _import == "__builtin__":
-            glob[_as or "__builtin__"] = __builtin__
-            return
+            raise Exception("Importing __builtin__ is forbidden")
         if _from == "__builtin__":
             _from = "six.moves.builtins"
         # The special `__sandbox__` module gives access to the sandbox

python/mozbuild/mozbuild/test/configure/test_configure.py

@@ -312,7 +312,9 @@ class TestConfigure(unittest.TestCase):
             sandbox,
         )
 
-        self.assertIs(sandbox["foo"](), six.moves.builtins)
+        with self.assertRaises(Exception) as e:
+            sandbox["foo"]()
+        self.assertEqual(str(e.exception), "Importing __builtin__ is forbidden")
 
         exec_(
             textwrap.dedent(
@@ -330,7 +332,7 @@ class TestConfigure(unittest.TestCase):
         self.assertEqual(f.name, os.devnull)
         f.close()
 
-        # This unlocks the sandbox
+        # This used to unlock the sandbox
         exec_(
             textwrap.dedent(
                 """
@@ -343,7 +345,9 @@ class TestConfigure(unittest.TestCase):
             sandbox,
         )
 
-        self.assertIs(sandbox["foo"](), sys)
+        with self.assertRaises(Exception) as e:
+            sandbox["foo"]()
+        self.assertEqual(str(e.exception), "Importing __builtin__ is forbidden")
 
         exec_(
             textwrap.dedent(