Patched code sample

import builtins

def execute_restricted_script(script_code: str):
    """
    Executes a Python script in a restricted environment to mitigate
    vulnerabilities like CVE-2025-13911.

    This function simulates a fix by creating a sandbox that controls
    which modules can be imported and which built-in functions can be
    accessed.
    """
    # 1. Define an allowlist of safe modules.
    # Any module not in this set cannot be imported by the user script.
    # Dangerous modules like 'os', 'subprocess', 'socket', 'sys' are omitted.
    ALLOWED_MODULES = {
        'math',
        'datetime',
        're',
        'json',
        'collections',
        'itertools'
        # Customer-specific or other vetted libraries could be added here.
    }

    # Keep a reference to the original, unrestricted import function.
    original_import = builtins.__import__

    def secure_import(name, globals=None, locals=None, fromlist=(), level=0):
        """
        A custom, secured version of the __import__ function. It checks the
        requested module name against the allowlist before proceeding.
        """
        # The 'name' argument is the top-level package (e.g., 'os.path' -> 'os')
        module_root = name.split('.')[0]
        if module_root not in ALLOWED_MODULES:
            raise ImportError(
                f"Disallowed import: '{name}'. Only modules from the "
                "approved list can be imported."
            )
        return original_import(name, globals, locals, fromlist, level)

    # 2. Create a restricted environment for the script execution.
    # We start with a dictionary of built-in functions.
    # The check for isinstance is to ensure compatibility across Python versions
    # and environments where __builtins__ can be a module or a dict.
    if isinstance(__builtins__, dict):
        safe_builtins = __builtins__.copy()
    else:
        safe_builtins = __builtins__.__dict__.copy()


    # 3. Override the __import__ function within the restricted environment.
    safe_builtins['__import__'] = secure_import

    # 4. For added security, remove other potentially dangerous built-ins
    # that could be used to execute system commands or access the filesystem.
    # This prevents direct access even if a module bypass were found.
    dangerous_builtins = [
        'open',          # Filesystem access
        'eval',          # Arbitrary code execution
        'exec',          # Arbitrary code execution
        'breakpoint',    # Debugging/introspection
        'compile',       # Code compilation
        'exit',          # Can terminate the gateway process
        'quit'           # Can terminate the gateway process
    ]
    for builtin_name in dangerous_builtins:
        if builtin_name in safe_builtins:
            safe_builtins[builtin_name] = None # Or raise an exception

    # The globals for the executed script will only contain our safe builtins.
    sandboxed_globals = {"__builtins__": safe_builtins}

    # 5. Execute the user's script within the sandboxed environment.
    # The script will only have access to the globals and locals provided.
    # Any attempt to 'import os' will be intercepted by 'secure_import'.
    try:
        exec(script_code, sandboxed_globals, {})
    except Exception as e:
        # In a real application, this error would be logged securely.
        print(f"Script execution failed with a security or runtime error: {e}")