Patched code sample

import os
import json
import subprocess
import shlex

# Assume this is the vulnerable function in TRTLLM's Python executor
# It takes a potentially untrusted config file path as input and executes a command based on it.
# This is a simplified example, the actual vulnerability might be more complex.
def execute_command_from_config(config_path):
    """
    Executes a command based on the configuration file.  VULNERABLE.
    """
    try:
        with open(config_path, 'r') as f:
            config = json.load(f)

        command = config.get('command')
        if not isinstance(command, str):
            raise ValueError("Command must be a string")


        # UNSAFE: Directly executing the command from the config file without validation
        # This is where the vulnerability lies. An attacker could craft a config file
        # with a malicious command, leading to code execution.

        #subprocess.run(command, shell=True, check=True) # VULNERABLE

        #Example of a potentially malicious config file (attacker controlled):
        # { "command": "rm -rf /" }

        return True

    except (FileNotFoundError, json.JSONDecodeError, KeyError, ValueError) as e:
        print(f"Error processing config file: {e}")
        return False
    except subprocess.CalledProcessError as e:
        print(f"Command execution failed: {e}")
        return False


# FIX: Implement proper input validation and sanitization.
#     Instead of directly executing the command, use a whitelist of allowed commands
#     or parameters, or use a safer alternative to shell=True.
def execute_command_from_config_fixed(config_path):
    """
    Executes a command based on the configuration file.  FIXED.
    """
    try:
        with open(config_path, 'r') as f:
            config = json.load(f)

        command = config.get('command')
        arguments = config.get('arguments', [])  # Get arguments from the config


        if not isinstance(command, str):
            raise ValueError("Command must be a string")
        if not isinstance(arguments, list):
            raise ValueError("Arguments must be a list")


        # SANITIZATION AND WHITELISTING (Example):

        # 1. Whitelist of allowed commands:
        allowed_commands = ['trtllm-generate', 'trtllm-process']  #Example only
        if command not in allowed_commands:
            raise ValueError(f"Command '{command}' is not allowed.")

        # 2. Sanitize Arguments (Very important):
        #    This is a placeholder; the actual sanitization needed depends on the allowed commands.
        #    This example checks for common injection attempts
        for arg in arguments:
            if not isinstance(arg, str):
                raise ValueError("Arguments must be strings")
            if ";" in arg or "|" in arg or ">" in arg or "<" in arg or "`" in arg:
                raise ValueError("Argument contains potentially dangerous characters")

        #3. Safe execution using subprocess.run with argument list (no shell=True)
        full_command = [command] + arguments
        result = subprocess.run(full_command, capture_output=True, text=True, check=True)
        print(result.stdout) #Capture stdout for debugging / logging

        return True

    except (FileNotFoundError, json.JSONDecodeError, KeyError, ValueError) as e:
        print(f"Error processing config file: {e}")
        return False
    except subprocess.CalledProcessError as e:
        print(f"Command execution failed: {e}")
        print(e.stderr) #Capture stderr for debugging
        return False