Patched code sample

import yaml
import argparse
import sys
import os

# This code represents the fixed version of 'tests/run.py' from the
# ms-swift project, addressing the unsafe deserialization vulnerability.
#
# The vulnerability (CVE-2025-50460) existed because the original code used
# `yaml.load()`, which can execute arbitrary code from a malicious YAML file.
#
# The fix is to replace the unsafe `yaml.load()` with `yaml.safe_load()`.
# The `safe_load` function can parse basic YAML tags but restricts it to
# simple Python objects like integers, strings, lists, and dictionaries,
# preventing the execution of arbitrary code.

def run_tests_fixed(config_path):
    """
    Loads a test configuration from a YAML file and runs tests.
    This version uses the secure yaml.safe_load() method.
    """
    if not os.path.exists(config_path):
        print(f"Error: Configuration file not found at '{config_path}'")
        sys.exit(1)

    print(f"Loading configuration securely from: {config_path}")
    try:
        with open(config_path, 'r') as f:
            # FIX: Using yaml.safe_load() instead of the vulnerable yaml.load().
            # yaml.safe_load() parses the YAML document without executing any
            # code, effectively mitigating the RCE vulnerability.
            config = yaml.safe_load(f)

        print("Configuration loaded successfully and safely.")
        print(f"Config content: {config}")
        # In a real application, test execution logic would follow.
        # For demonstration, we just print the loaded config.

    except yaml.YAMLError as e:
        print(f"Error parsing YAML file: {e}")
        # If a malicious payload like '!!python/object/apply:os.system'
        # is present, safe_load will raise a YAMLError (ConstructorError)
        # instead of executing the command.
        print("The provided YAML file may contain unsafe constructs not allowed by safe_load.")
        sys.exit(1)


if __name__ == '__main__':
    parser = argparse.ArgumentParser(
        description="Fixed test runner for ms-swift project. Demonstrates the fix for CVE-2025-50460."
    )
    parser.add_argument(
        '--run_config',
        required=True,
        help='Path to the YAML configuration file.'
    )
    args = parser.parse_args()

    run_tests_fixed(args.run_config)

# To test this fix, you can create two YAML files.
#
# 1. A safe configuration file (e.g., 'safe_config.yaml'):
# ---
# test_suite: 'smoke_tests'
# parameters:
#   retries: 3
#   timeout: 60
#
# Command: python fixed_run.py --run_config safe_config.yaml
# Expected Output: The script will load and print the configuration dictionary.
#
# 2. A malicious configuration file (e.g., 'malicious_config.yaml'):
# ---
# !!python/object/apply:os.system
# - "echo 'This command should NOT be executed.'"
#
# Command: python fixed_run.py --run_config malicious_config.yaml
# Expected Output: The script will raise a YAMLError and exit, preventing
#                  the command from being executed. This demonstrates the
#                  vulnerability has been mitigated.