Evaluator Rewrite - GCC

[JersyJ]

• Rewrite of the GCC pipeline, to use entry.py in Evaluator and usage of docker run architecture instead of relying on entry.py in Docker Image
• Standardize the HTML output
• Use nh3 instead of bleach for sanitization
• Implements filename filtering to block files with dangerous characters from uploads and source listings

[Copilot]

Pull request overview

This PR implements a rewrite of the GCC evaluator using a new architecture with type handlers. It introduces HTML sanitization using the nh3 library and adds filename validation to prevent XSS attacks through malicious filenames.

Changes:

• Adds nh3 library (>=0.3.3) for HTML sanitization to prevent XSS vulnerabilities
• Creates new type handler architecture with TypeHandler base class and Gcc implementation for C/C++ compilation
• Implements filename filtering to block files with dangerous characters from uploads and source listings

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
uv.lock	Adds nh3 0.3.3 dependency with wheel distributions for multiple platforms
pyproject.toml	Adds nh3>=0.3.3 to project dependencies
evaluator/type_handlers.py	New file implementing TypeHandler base class and Gcc handler for C/C++ compilation with Docker isolation and HTML sanitization
evaluator/pipelines.py	Adds TypePipe base class and GccPipe implementation integrating the new type handler architecture
common/utils.py	Adds has_unsafe_filename() function to detect dangerous characters in filenames
common/upload.py	Filters uploaded files with unsafe filenames
common/models.py	Filters source files with unsafe filenames when listing all sources

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JersyJ]

Hi @Jan1s2, could you check this PR based on the previous PR #822 discussion? Thanks a lot in advance.

[Jan1s2]

Before anything else, in terms of security, I do not see any issues.

The only "issues" that I found would be cosmetic things:

• When there is a warning in GCC, there does not seem to be any whitespace between "Stderr" and the actual stderr output, so it ends up looking like Stderrmain.c: ...
• I have noticed that it "lost" the color formatting of GCC's warning/error output, but I guess it would be nearly impossible to do it in a way that would be actually secure, so, that's fine with me.