Patched code sample

from vault_cli import get_client
import re
from typing import Dict, Any, Optional

class SecureVaultManager:
    """Secure vault client management without template injection vulnerabilities."""
    
    def __init__(self):
        self.max_path_length = 200
        self.allowed_path_pattern = re.compile(r'^[a-zA-Z0-9/_-]+$')
        self.dangerous_template_patterns = [
            r'\{\{.*?\}\}',  # Template expressions
            r'subprocess', r'__import__', r'eval', r'os\.system',
            r'open\s*\(', r'file\s*\('
        ]
    
    def get_secret(self, secret_path: str) -> Dict[str, Any]:
        """Secure function that gets secrets without template injection risks."""
        
        # Input validation
        if not isinstance(secret_path, str):
            raise ValueError("Secret path must be a string")
        
        if len(secret_path.strip()) == 0:
            raise ValueError("Secret path cannot be empty")
        
        if len(secret_path) > self.max_path_length:
            raise ValueError("Secret path too long")
        
        # Sanitize and validate path
        clean_path = secret_path.strip()
        
        if not self.allowed_path_pattern.match(clean_path):
            raise ValueError("Secret path contains invalid characters")
        
        # Check for template injection attempts
        if self._contains_template_injection(clean_path):
            raise ValueError("Template injection attempt detected in path")
        
        try:
            # SECURE: Disable template rendering to prevent RCE
            client = get_client(render=False)  # CRITICAL: Template rendering disabled
            
            # Get secret safely without template processing
            secret = client.get(clean_path)
            
            # Additional validation of returned data
            if secret and isinstance(secret, dict):
                validated_secret = self._validate_secret_data(secret)
                return {
                    'success': True,
                    'secret': validated_secret,
                    'path': clean_path,
                    'message': 'Secret retrieved securely'
                }
            else:
                return {
                    'success': False,
                    'error': 'Invalid secret format',
                    'path': clean_path,
                    'message': 'Secret validation failed'
                }
                
        except Exception as e:
            return {
                'success': False,
                'error': str(e),
                'path': clean_path,
                'message': 'Secret retrieval failed'
            }
    
    def process_vault_data(self, path: str, template_data: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
        """Secure function that processes vault data without template injection."""
        
        # Input validation
        if not isinstance(path, str):
            raise ValueError("Path must be a string")
        
        # Validate path
        clean_path = path.strip()
        if not self.allowed_path_pattern.match(clean_path):
            raise ValueError("Path contains invalid characters")
        
        # Check for template injection in path
        if self._contains_template_injection(clean_path):
            raise ValueError("Template injection detected in path")
        
        # Validate template data if provided
        if template_data is not None:
            if not isinstance(template_data, dict):
                raise ValueError("Template data must be a dictionary")
            
            # Check template data for injection attempts
            for key, value in template_data.items():
                if isinstance(value, str) and self._contains_template_injection(value):
                    raise ValueError(f"Template injection detected in data key: {key}")
        
        try:
            # SECURE: Always disable template rendering
            client = get_client(render=False)
            
            # Process data without template rendering
            if template_data:
                # Filter and sanitize template data
                safe_data = self._sanitize_template_data(template_data)
                result = client.get(clean_path, **safe_data)
            else:
                result = client.get(clean_path)
            
            return {
                'success': True,
                'data': result,
                'path': clean_path,
                'message': 'Vault data processed securely'
            }
            
        except Exception as e:
            return {
                'success': False,
                'error': str(e),
                'path': clean_path,
                'message': 'Vault data processing failed'
            }
    
    def _contains_template_injection(self, content: str) -> bool:
        """Check for template injection patterns."""
        
        for pattern in self.dangerous_template_patterns:
            if re.search(pattern, content, re.IGNORECASE):
                return True
        return False
    
    def _validate_secret_data(self, secret: Dict[str, Any]) -> Dict[str, Any]:
        """Validate and sanitize secret data."""
        
        validated = {}
        
        for key, value in secret.items():
            # Validate key
            if isinstance(key, str) and len(key) <= 100:
                # Validate value
                if isinstance(value, (str, int, float, bool)):
                    if isinstance(value, str) and len(value) <= 1000:
                        validated[key] = value
                    elif not isinstance(value, str):
                        validated[key] = value
        
        return validated
    
    def _sanitize_template_data(self, template_data: Dict[str, Any]) -> Dict[str, Any]:
        """Sanitize template data to remove dangerous content."""
        
        sanitized = {}
        
        for key, value in template_data.items():
            # Only allow safe string keys
            if isinstance(key, str) and len(key) <= 50:
                clean_key = re.sub(r'[^a-zA-Z0-9_]', '', key)
                
                # Only allow safe values
                if isinstance(value, (str, int, float, bool)):
                    if isinstance(value, str):
                        # Remove template patterns from string values
                        clean_value = re.sub(r'\{\{.*?\}\}', '', value)
                        if len(clean_value) <= 200:
                            sanitized[clean_key] = clean_value
                    else:
                        sanitized[clean_key] = value
        
        return sanitized

# Example of secure usage:
vault_manager = SecureVaultManager()
# result = vault_manager.get_secret("secret/myapp/config")  # Secure secret retrieval
# data = vault_manager.process_vault_data("secret/data", {"env": "production"})  # Safe processing