Sandboxing and Allowed Imports

Plugins developed with the Canvas SDK operate within a sandboxed environment. This sandbox strictly limits access to the host operating system, filesystem, and database. This security measure is designed to mitigate risks associated with accidental misconfigurations or malicious activities, thereby safeguarding sensitive patient data.

Standard Library Modules #

The following Python standard library modules and their allowed imports are available within the sandbox:

__future__ #

Provides access to features from future Python versions for backwards compatibility. read more

  • annotations
abc #

Provides infrastructure for defining Abstract Base Classes (ABCs) to enforce interfaces and create structured inheritance hierarchies. read more

  • ABC
  • abstractmethod
base64 #

Provides functions for encoding and decoding data in base64 format, commonly used for data transmission and storage. read more

  • b64decode
  • b64encode
collections #

Provides specialized container datatypes that extend beyond the built-in types like lists and dictionaries. read more

  • Counter
  • defaultdict
datetime #

Provides classes for working with dates and times, essential for medical applications that need to track appointment schedules and patient timelines. read more

  • date
  • datetime
  • timedelta
  • timezone
  • UTC
dateutil #

Extends Python’s datetime capabilities with more flexible date parsing and arithmetic. read more

  • relativedelta
dateutil.relativedelta #

Provides relative time delta calculations for more complex date arithmetic operations. read more

  • relativedelta
decimal #

Provides precise decimal arithmetic for financial and scientific calculations where floating-point accuracy is critical. read more

  • Decimal
enum #

Provides support for enumerations, useful for defining sets of named constants such as status codes or categories. read more

  • Enum
  • StrEnum
functools #

Provides utilities for higher-order functions and operations on callable objects. read more

  • reduce
hashlib #

Provides secure hash and message digest algorithms for data integrity verification and security purposes. read more

  • sha256
hmac #

Provides hash-based message authentication code (HMAC) functions for secure message authentication. read more

  • compare_digest
  • new
http #

Provides HTTP status codes and related constants for web API development and HTTP response handling. read more

  • HTTPStatus
json #

Provides functions for parsing and generating JSON data, essential for API communication and data serialization. read more

  • dumps
  • loads
operator #

Provides function equivalents of operators for functional programming and complex data operations. read more

  • and_
random #

Provides functions for generating random numbers and making random selections, useful for sampling and testing scenarios. read more

  • choices
  • uniform
  • randint
re #

Provides regular expression matching operations for pattern matching and text processing. read more

  • compile
  • DOTALL
  • IGNORECASE
  • match
  • search
  • split
  • sub
string #

Provides string constants and template classes for string manipulation and formatting operations. read more

  • ascii_lowercase
  • digits
time #

Provides time-related functions for measuring execution time and adding delays in processing. read more

  • time
  • sleep
typing #

Provides support for type hints and static type checking to improve code clarity and IDE support. read more

  • Any
  • cast
  • Dict
  • Final
  • Iterable
  • List
  • Literal
  • NamedTuple
  • NotRequired
  • Protocol
  • Optional
  • Sequence
  • Tuple
  • Type
  • TypeGuard
  • TypedDict
  • TypeGuard
  • Union
urllib #

Provides modules for working with URLs, including URL parsing and manipulation. read more

  • parse
urllib.parse #

Provides URL parsing utilities for breaking apart and constructing URLs and query strings. read more

  • urlencode
  • quote
uuid #

Provides functions for generating universally unique identifiers (UUIDs) for creating unique record identifiers. read more

  • uuid4
  • UUID
zoneinfo #

Provides timezone support for handling datetime objects across different time zones. read more

  • ZoneInfo

Third-Party Modules #

The following third-party modules and their allowed imports are available within the sandbox:

arrow #

A human-friendly approach to creating, manipulating, formatting and converting dates and times. read more

  • get
  • now
  • utcnow
django.db.models #

Django’s database abstraction layer for defining database models and performing queries. read more

  • BigIntegerField
  • Case
  • CharField
  • IntegerField
  • Model
  • Q
  • Value
  • When
django.db.models.expressions #

Django’s database expressions for complex query operations and conditional logic. read more

  • Case
  • Value
  • When
django.db.models.query #

Django’s QuerySet class for database query operations and result handling. read more

  • QuerySet
django.utils.functional #

Django’s functional programming utilities including caching and lazy evaluation tools. read more

  • cached_property
jwt #

A library for encoding and decoding JSON Web Tokens (JWT) for secure data transmission and authentication. read more

  • decode
  • encode
  • ExpiredSignatureError
  • InvalidTokenError
  • PyJWKClient
pydantic #

A data validation library using Python type annotations for parsing and validating data structures. read more

  • BaseModel
  • conint
  • ConfigDict
  • constr
  • Field
  • RootModel
  • ValidationError
rapidfuzz #

A fast string matching library for fuzzy string comparison and search operations. read more

  • fuzz
  • process
  • utils
requests #

A simple and elegant HTTP library for making web requests and API calls. read more

  • delete
  • get
  • patch
  • post
  • put
  • request
  • RequestException
  • Response

Canvas SDK Modules #

All Canvas SDK modules are available for import and use within your plugins:

  • canvas_sdk.caching
  • canvas_sdk.commands
  • canvas_sdk.effects
  • canvas_sdk.events
  • canvas_sdk.handlers
  • canvas_sdk.protocols
  • canvas_sdk.questionnaires
  • canvas_sdk.templates
  • canvas_sdk.utils
  • canvas_sdk.v1.data
  • canvas_sdk.value_set
  • canvas_sdk.views
  • logger

Builtin Functions #

The following Python builtin functions are available within the sandbox:

  • all
  • any
  • classmethod
  • dict
  • enumerate
  • filter
  • getattr
  • hasattr
  • iter
  • list
  • map
  • max
  • min
  • next
  • property
  • reversed
  • staticmethod
  • super
  • vars

Plus all the standard safe builtins from RestrictedPython including basic types (bool, int, float, str, tuple, etc.) and safe operations.

Requesting Additional Imports #

If there is a library or function not on this list that you wish to import in your plugin, reach out on the Canvas developer forum. Additional imports can often be added after a security review.

The allowed imports are defined in the Canvas Plugins repository and are regularly updated to support common development needs while maintaining security.

Policy on Vendor-Specific Libraries: #

The current policy strongly discourages the inclusion of vendor-specific libraries. Introducing such libraries presents several challenges:

  • Vendor Prioritization: It risks implicitly favoring one vendor over others, which can be problematic in a multi-vendor ecosystem.

  • Dependency Bloat: Incorporating libraries for each vendor within a specific category (e.g., AI model providers like OpenAI, Anthropic) leads to a significant increase in overall dependencies.

Technical Implications of Excessive Dependencies: #

Adding a multitude of vendor-specific libraries can result in:

  • Increased Memory Usage: Each additional library contributes to the application’s memory footprint.

  • Dependency Conflicts: Different libraries may require different versions of shared dependencies, leading to versioning conflicts and system instability.

Given these considerations, the platform maintains a strict and judicious approach to approving and incorporating external libraries or imports.

Questions? Create an issue.
On this page