Patched code sample

import ast
from flask import Flask, request, jsonify

# This is a hypothetical representation of the Aim backend service.
# The code demonstrates a fix for a vulnerability where user-submitted Python code
# could execute arbitrary JavaScript via Pyodide on the frontend.
#
# The vulnerability (CVE-2025-51464) description states that no sanitisation
# prevented the use of `pyodide.code.run_js()`.
#
# THE FIX:
# The fix is to implement server-side validation of the Python code before it is
# stored and sent to the frontend for execution. This validation uses Python's
# Abstract Syntax Tree (AST) module to parse the code and inspect it for
# disallowed patterns, such as importing the 'pyodide' module or calling
# the dangerous 'run_js' function. If a forbidden pattern is detected, the
# request is rejected.

app = Flask(__name__)

# In a real application, this would be a database.
REPORTS_STORAGE = {}


class PyodideCodeValidator(ast.NodeVisitor):
    """
    AST visitor to check for disallowed patterns in user-submitted Python code.
    It specifically looks for imports of 'pyodide' and calls to 'run_js'.
    """

    def __init__(self):
        self.is_safe = True
        self.errors = []

    def visit_Import(self, node):
        for alias in node.names:
            if alias.name == 'pyodide':
                self.is_safe = False
                self.errors.append("Direct import of 'pyodide' is not allowed.")
        self.generic_visit(node)

    def visit_ImportFrom(self, node):
        if node.module == 'pyodide':
            self.is_safe = False
            self.errors.append("Import from 'pyodide' is not allowed.")
        self.generic_visit(node)

    def visit_Call(self, node):
        # Check for calls like `some_object.run_js(...)`
        if isinstance(node.func, ast.Attribute) and node.func.attr == 'run_js':
            self.is_safe = False
            self.errors.append("Calls to 'run_js' are not allowed.")
        # Check for simple calls like `run_js(...)` if it were imported directly
        elif isinstance(node.func, ast.Name) and node.func.id == 'run_js':
            self.is_safe = False
            self.errors.append("Calls to 'run_js' are not allowed.")
        self.generic_visit(node)


def is_code_safe_for_pyodide(code_string: str) -> (bool, list):
    """
    Parses a Python code string into an AST and uses the validator to check it.

    Returns a tuple containing a boolean (True if safe) and a list of errors.
    """
    try:
        tree = ast.parse(code_string)
        validator = PyodideCodeValidator()
        validator.visit(tree)
        return validator.is_safe, validator.errors
    except SyntaxError as e:
        return False, [f"Invalid Python syntax: {e}"]


@app.route('/api/reports', methods=['POST'])
def create_report():
    """
    Endpoint to receive Python code for a new report.
    This endpoint now includes the security validation fix.
    """
    payload = request.get_json()
    if not payload or 'python_code' not in payload:
        return jsonify({"error": "Request must include 'python_code' field."}), 400

    user_code = payload['python_code']

    # --- FIX IMPLEMENTED HERE ---
    # The user-submitted code is validated before being accepted.
    is_safe, errors = is_code_safe_for_pyodide(user_code)

    if not is_safe:
        # If the code is not safe, reject the request with an error message.
        return jsonify({
            "error": "Malicious code pattern detected.",
            "details": errors
        }), 400
    # --- END OF FIX ---

    # If the code passes validation, it is stored.
    # The frontend can now safely fetch and execute this code with Pyodide,
    # confident that it cannot call `run_js` to perform an XSS attack.
    report_id = len(REPORTS_STORAGE) + 1
    REPORTS_STORAGE[report_id] = {"content": user_code}

    return jsonify({
        "message": "Report created successfully with validated code.",
        "report_id": report_id
    }), 201


if __name__ == '__main__':
    # To test this fix:
    # 1. Run this script.
    # 2. Send POST requests to http://127.0.0.1:5000/api/reports
    #
    # Example of a SAFE request (will be accepted):
    # curl -X POST -H "Content-Type: application/json" -d '{"python_code": "x = 1\ny = 2\nprint(f''Result: {x+y}'')"}' http://127.0.0.1:5000/api/reports
    #
    # Example of a MALICIOUS request (will be rejected by the fix):
    # curl -X POST -H "Content-Type: application/json" -d '{"python_code": "import pyodide\npyodide.code.run_js(\"alert(''XSS'');\")"}' http://127.0.0.1:5000/api/reports
    #
    # Another MALICIOUS example (will be rejected by the fix):
    # curl -X POST -H "Content-Type: application/json" -d '{"python_code": "api.run_js(\"alert(''XSS'');\")"}' http://127.0.0.1:5000/api/reports

    app.run(port=5000)