Patched code sample

import math
import ast

def get_safe_rosparam_loader():
    """
    This function returns a safe loader that mimics the patched rosparam behavior.
    The original vulnerability in CVE-2024-39289 existed because a function
    similar to this would call eval() on the entire input string for angle
    conversions, allowing arbitrary code execution.

    The fix involves two key changes demonstrated here:
    1.  Explicitly parsing the 'rad(...)' structure instead of evaluating it
        directly.
    2.  Using a sandboxed eval() with a restricted 'globals' dictionary for the
        mathematical expression *inside* 'rad(...)'. This prevents access to
        harmful built-in functions like `__import__`.
    3.  Using the much safer `ast.literal_eval` for any other data that
        is not a plain string, which handles basic Python types without
        executing code.
    """
    # Define a safe evaluation context for mathematical expressions.
    # It explicitly provides allowed names (like 'pi') and disables built-ins.
    safe_math_globals = {
        "__builtins__": None,
        "pi": math.pi,
        "e": math.e,
        "sin": math.sin,
        "cos": math.cos,
        "tan": math.tan,
    }

    def safe_load(value_str):
        """
        Represents the fixed logic for loading a rosparam value.
        """
        # A malicious input that would have been executed by the vulnerable version:
        # "rad(__import__('os').system('echo pwned'))"
        
        s = value_str.strip()

        # Check specifically for the 'rad(...)' converter syntax
        if s.startswith('rad(') and s.endswith(')'):
            # Extract only the expression inside the parentheses
            expression = s[4:-1]
            try:
                # CORE OF THE FIX: Evaluate the expression in a sandboxed environment
                # with a strictly limited set of globals and no locals.
                return eval(expression, safe_math_globals, {})
            except Exception as e:
                raise ValueError(f"Invalid or unsafe expression in rad(): {expression}") from e
        
        # For all other values, use the safe ast.literal_eval.
        # This handles numbers, lists, dictionaries, etc., without code execution.
        try:
            return ast.literal_eval(s)
        except (ValueError, SyntaxError, TypeError):
            # If it's not a valid Python literal, it's treated as a plain string.
            # This is the standard rosparam behavior for non-special values.
            return value_str

    return safe_load

if __name__ == '__main__':
    # Demonstration of the fixed loader
    
    safe_loader = get_safe_rosparam_loader()
    
    # --- Test Cases ---

    # 1. Benign: A valid angle in radians using a math expression
    valid_angle_str = "rad(pi / 2)"
    try:
        result = safe_loader(valid_angle_str)
        print(f"Input: '{valid_angle_str}'\nResult: {result} (Correctly evaluated to {math.pi / 2})")
    except Exception as e:
        print(f"Input: '{valid_angle_str}'\nError: {e}")
    
    print("-" * 20)

    # 2. Benign: A simple number
    valid_number_str = "123.45"
    try:
        result = safe_loader(valid_number_str)
        print(f"Input: '{valid_number_str}'\nResult: {result} (Type: {type(result)})")
    except Exception as e:
        print(f"Input: '{valid_number_str}'\nError: {e}")

    print("-" * 20)

    # 3. Benign: A list
    valid_list_str = "[1, 2, 'hello']"
    try:
        result = safe_loader(valid_list_str)
        print(f"Input: '{valid_list_str}'\nResult: {result} (Type: {type(result)})")
    except Exception as e:
        print(f"Input: '{valid_list_str}'\nError: {e}")

    print("-" * 20)

    # 4. Malicious: Attempted code execution (THE VULNERABILITY)
    # In the old system, this would have executed the command.
    # In the new, fixed system, it raises an error.
    malicious_str = "rad(__import__('os').system('echo vulnerable'))"
    try:
        result = safe_loader(malicious_str)
        print(f"Input: '{malicious_str}'\nResult: {result}")
    except Exception as e:
        print(f"Input: '{malicious_str}'\nSuccessfully Blocked! Error: {e}")