Disable network in sandboxes by default (#3716)

UebelAndre · web-flow · commit 61df06074907 · 2025-11-06T21:44:35.000Z
And format additional files.
diff --git a/.bazelrc b/.bazelrc
@@ -23,6 +23,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/examples/crate_universe/.bazelrc b/examples/crate_universe/.bazelrc
@@ -26,6 +26,9 @@ build --nolegacy_external_runfiles
 # https://github.com/bazelbuild/bazel/issues/23043.
 build --incompatible_autoload_externally=
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Bzlmod
 ###############################################################################
diff --git a/extensions/bindgen/.bazelrc b/extensions/bindgen/.bazelrc
@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/extensions/mdbook/.bazelrc b/extensions/mdbook/.bazelrc
@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/extensions/prost/.bazelrc b/extensions/prost/.bazelrc
@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/extensions/protobuf/.bazelrc b/extensions/protobuf/.bazelrc
@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/extensions/wasm_bindgen/.bazelrc b/extensions/wasm_bindgen/.bazelrc
@@ -25,6 +25,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/ffi/rs/allocator_library/empty.rs b/ffi/rs/allocator_library/empty.rs
@@ -0,0 +1 @@
+
diff --git a/ffi/rs/global_allocator_library/empty.rs b/ffi/rs/global_allocator_library/empty.rs
@@ -0,0 +1 @@
+
diff --git a/ffi/rs/global_allocator_library/global_allocator_library.rs b/ffi/rs/global_allocator_library/global_allocator_library.rs
@@ -35,7 +35,6 @@ fn __rust_alloc_error_handler(size: usize, align: usize) {
     }
 }
 
-
 // New feature as of https://github.com/rust-lang/rust/pull/88098.
 // This symbol is normally emitted by rustc. 0 means OOMs should abort, 1 means OOMs should panic.
 #[linkage = "weak"]
diff --git a/test/cargo_build_script/build_script_env_files/build.rs b/test/cargo_build_script/build_script_env_files/build.rs
@@ -1,3 +1,6 @@
 fn main() {
-    println!("cargo:rustc-env=FROM_BUILD_SCRIPT={}", std::env::var("GREETING").unwrap());
+    println!(
+        "cargo:rustc-env=FROM_BUILD_SCRIPT={}",
+        std::env::var("GREETING").unwrap()
+    );
 }
diff --git a/test/cargo_build_script/tools_exec/build.rs b/test/cargo_build_script/tools_exec/build.rs
@@ -48,7 +48,8 @@ fn main() {
     for env_var in &["CARGO", "CC", "CXX", "LD", "RUSTC"] {
         let path = std::env::var(env_var)
             .unwrap_or_else(|err| panic!("Error getting {}: {}", env_var, err));
-        std::process::Command::new(&path).status()
+        std::process::Command::new(&path)
+            .status()
             .unwrap_or_else(|err| panic!("Error executing {}: {}", path, err));
     }
 

Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,6 @@ fn __rust_alloc_error_handler(size: usize, align: usize) {`
`35`	`35`	`}`
`36`	`36`	`}`
`37`	`37`
`38`		`-`
`39`	`38`	`// New feature as of https://github.com/rust-lang/rust/pull/88098.`
`40`	`39`	`// This symbol is normally emitted by rustc. 0 means OOMs should abort, 1 means OOMs should panic.`
`41`	`40`	`#[linkage = "weak"]`