Fix #1708 - Don't modify linters or register fixers in the sandbox

test/test_sandbox_execution.vader

@@ -24,10 +24,13 @@ Before:
   let g:ale_buffer_info = {}
 
 After:
+  unlet! b:in_sandbox
+  unlet! b:result
+
   delfunction TestCallback
   call ale#linter#Reset()
   let g:ale_buffer_info = {}
-  unlet! b:in_sandbox
+
 
 Given foobar (Some imaginary filetype):
   foo
@@ -61,3 +64,41 @@ Execute(ALE shouldn't blow up if file cleanup happens in a sandbox):
 
   AssertEqual ['/tmp/foo'], g:ale_buffer_info[3].temporary_file_list
   AssertEqual ['/tmp/bar'], g:ale_buffer_info[3].temporary_directory_list
+
+Execute(You shouldn't be able to define linters from the sandbox):
+  call ale#linter#Reset()
+  call ale#linter#PreventLoading('testft')
+
+  AssertThrows sandbox call ale#linter#Define('testft', {
+  \ 'name': 'testlinter',
+  \ 'output_stream': 'stdout',
+  \ 'executable': 'testlinter',
+  \ 'command': 'testlinter',
+  \ 'callback': 'testCB',
+  \})
+  AssertEqual 'Vim(let):E48: Not allowed in sandbox', g:vader_exception
+  AssertEqual [], ale#linter#GetAll(['testft'])
+
+Execute(You shouldn't be able to register fixers from the sandbox):
+  call ale#fix#registry#Clear()
+  AssertThrows sandbox call ale#fix#registry#Add('prettier', '', ['javascript'], 'prettier')
+  AssertEqual 'Vim(let):E48: Not allowed in sandbox', g:vader_exception
+  AssertEqual [], ale#fix#registry#CompleteFixers('', 'ALEFix ', 7)
+
+Execute(You shouldn't be able to get linters from the sandbox, to prevent tampering):
+  AssertThrows sandbox call ale#linter#GetLintersLoaded()
+  AssertEqual 'Vim(let):E48: Not allowed in sandbox', g:vader_exception
+
+  call ale#linter#Reset()
+
+  sandbox let b:result = ale#linter#GetAll(['testft'])
+
+  AssertEqual 0, len(b:result)
+
+  let b:result = ale#linter#GetAll(['testft'])
+
+  AssertEqual 1, len(b:result)
+
+  sandbox let b:result = ale#linter#GetAll(['testft'])
+
+  AssertEqual 0, len(b:result)