fix: block posix, nt, _posixsubprocess, and _socket modules in agent config validation

Merge google#6389

PiperOrigin-RevId: 948150331

Author: yusmer96-maker

src/google/adk/agents/config_agent_utils.py

@@ -143,7 +143,10 @@ def _load_config_from_path(config_path: str) -> AgentConfig:
 _BLOCKED_MODULES = frozenset({
     # Process / OS execution
     "os",
+    "posix",  # Unix alias: posix.system is os.system
+    "nt",  # Windows alias: nt.system is os.system
     "subprocess",
+    "_posixsubprocess",
     "sys",
     "builtins",
     "importlib",
@@ -160,6 +163,7 @@ def _load_config_from_path(config_path: str) -> AgentConfig:
     "ctypes",
     # Network access
     "socket",
+    "_socket",
     "http",
     "urllib",
     "ftplib",

tests/unittests/agents/test_agent_config.py

@@ -526,7 +526,12 @@ def test_allowed_module_passes_when_enforced(tmp_path: Path):
     "blocked_module",
     [
         "os.system",
+        "posix.system",
+        "nt.system",
         "subprocess.call",
+        "_posixsubprocess.fork_exec",
+        "socket.socket",
+        "_socket.socket",
         "builtins.exec",
     ],
 )
@@ -542,7 +547,12 @@ def test_resolve_agent_code_reference_blocks_when_enforced(
     "blocked_ref",
     [
         "os.system",
+        "posix.system",
+        "nt.system",
         "subprocess.call",
+        "_posixsubprocess.fork_exec",
+        "socket.socket",
+        "_socket.socket",
         "builtins.exec",
         "pickle.loads",
     ],