Patched code sample

import html
import re
import json
from typing import Any, Dict, Union

class SecureDataProcessor:
    """Secure data processing with comprehensive input validation and sanitization."""
    
    def __init__(self):
        self.max_input_size = 10000
        self.allowed_types = (str, int, float, bool)
        self.dangerous_patterns = [
            '<script', 'javascript:', 'vbscript:', 'data:',
            'on\w+\s*=', '__import__', 'eval\s*\(',
            'DROP\s+TABLE', 'DELETE\s+FROM', 'INSERT\s+INTO',
            'UPDATE\s+SET', 'UNION\s+SELECT'
        ]
    
    def process_user_data(self, user_input: Any) -> Dict[str, Any]:
        """Secure function that processes user data with comprehensive validation."""
        
        # Type validation
        if not isinstance(user_input, self.allowed_types):
            raise ValueError("Input type not allowed")
        
        # Convert to string for processing
        input_str = str(user_input)
        
        # Size validation
        if len(input_str) > self.max_input_size:
            raise ValueError("Input too large")
        
        # Security validation
        if self._contains_dangerous_patterns(input_str):
            raise ValueError("Input contains potentially dangerous content")
        
        # Sanitize input
        sanitized_input = self._sanitize_input(input_str)
        
        # Role-based processing with proper validation
        if self._is_admin_request(sanitized_input):
            # Proper admin validation would go here
            return {
                'success': True,
                'result': 'Admin request detected - requires proper authentication',
                'processed_data': sanitized_input[:100],  # Limit output
                'message': 'Admin access requires additional validation'
            }
        
        return {
            'success': True,
            'result': f"Securely processed: {sanitized_input[:100]}",
            'processed_data': sanitized_input,
            'message': 'Data processed securely'
        }
    
    def handle_data(self, data: Any) -> Dict[str, Any]:
        """Secure data handler with proper validation and error handling."""
        
        try:
            # Validate data structure
            if data is None:
                raise ValueError("Data cannot be None")
            
            # Process data securely
            result = self.process_user_data(data)
            
            return {
                'success': True,
                'result': result,
                'data_type': type(data).__name__,
                'message': 'Data handled securely'
            }
            
        except ValueError as e:
            return {
                'success': False,
                'error': str(e),
                'message': 'Data validation failed'
            }
        except Exception as e:
            return {
                'success': False,
                'error': 'Processing error',
                'message': 'Unexpected error during data processing'
            }
    
    def _contains_dangerous_patterns(self, content: str) -> bool:
        """Check for dangerous patterns in input content."""
        
        content_lower = content.lower()
        for pattern in self.dangerous_patterns:
            if re.search(pattern, content_lower, re.IGNORECASE):
                return True
        return False
    
    def _sanitize_input(self, input_str: str) -> str:
        """Sanitize input string to remove dangerous content."""
        
        # HTML escape to prevent XSS
        sanitized = html.escape(input_str, quote=True)
        
        # Remove script tags
        sanitized = re.sub(r'<script[^>]*>.*?</script>', '', sanitized, flags=re.IGNORECASE | re.DOTALL)
        
        # Remove event handlers
        sanitized = re.sub(r'on\w+\s*=\s*["'][^"']*["']', '', sanitized, flags=re.IGNORECASE)
        
        # Remove SQL injection patterns
        sanitized = re.sub(r'(DROP|DELETE|INSERT|UPDATE|UNION)\s+(TABLE|FROM|INTO|SET|SELECT)', 
                          '', sanitized, flags=re.IGNORECASE)
        
        # Limit length
        if len(sanitized) > 1000:
            sanitized = sanitized[:1000]
        
        return sanitized.strip()
    
    def _is_admin_request(self, content: str) -> bool:
        """Safely check if content contains admin-related keywords."""
        
        admin_keywords = ['admin', 'administrator', 'root', 'superuser']
        content_lower = content.lower()
        
        return any(keyword in content_lower for keyword in admin_keywords)
    
    def validate_input_safety(self, input_data: Any) -> Dict[str, Any]:
        """Validate input for safety and provide detailed feedback."""
        
        issues = []
        warnings = []
        
        input_str = str(input_data)
        
        # Check size
        if len(input_str) > 5000:
            warnings.append('Large input size')
        
        # Check for dangerous patterns
        if self._contains_dangerous_patterns(input_str):
            issues.append('Dangerous patterns detected')
        
        # Check for suspicious characters
        if re.search(r'[<>"\'`]', input_str):
            warnings.append('Special characters detected')
        
        return {
            'is_safe': len(issues) == 0,
            'issues': issues,
            'warnings': warnings,
            'input_size': len(input_str)
        }

# Example of secure usage:
processor = SecureDataProcessor()
# result = processor.process_user_data("safe user input")  # Secure processing
# handled = processor.handle_data("test data")  # Safe data handling
# validation = processor.validate_input_safety(user_input)  # Input validation