Declarative Hook Registry (docker/hook_registry.py)

Schema‑validated, safe registry for browser hook actions, replacing exec‑based hooks in the Docker server.

# Source: https://github.com/mperkins0155/crawl4ai-cobaltai | License: Apache-2.0
# Provided via justclaw.it.com; keep this notice with the code.
"""
Declarative hook registry - the safe replacement for the exec-based hook system.

The old hook_manager.py compiled and exec()'d user-supplied Python at crawl hook
points. Its sandbox was unsound (escapable via __subclasses__ MRO walks, injected
module __globals__, frame inspection), giving unauthenticated RCE when hooks were
enabled. There is no safe way to run attacker Python in-process.

Instead, a request may only choose from a fixed set of declarative ACTIONS whose
parameters are schema-validated scalars. Each action maps to a server-authored
async function that calls exactly one specific Playwright API - no user string
ever reaches an in

... (truncated -- full source via MCP)