Patched code sample

import sys

# The original built-in import function, to be used for safe modules.
_orig_import = __import__

# A set of module names that are considered dangerous and should be blocked.
# This list is central to the fix, preventing access to networking,
# subprocesses, and the file system, which could be used to reach
# internal services.
BLOCKED_MODULES = {
    'socket',
    'urllib',
    'http',
    'ftplib',
    'telnetlib',
    'subprocess',
    'os',
    'shutil',
    'asyncio',
    'requests'  # A common third-party library for networking.
}


def _secure_importer(name, globals=None, locals=None, fromlist=(), level=0):
    """
    A custom __import__ function that acts as a security gate.
    It checks if the module being imported is in the blocklist.
    """
    if name in BLOCKED_MODULES:
        raise ImportError(f"Import of disabled module '{name}' is not allowed.")

    # If the module is not in the blocklist, delegate to the original import.
    # Note: In a real-world, high-security sandbox, you would use an allowlist
    # instead of a blocklist for greater security.
    return _orig_import(name, globals, locals, fromlist, level)


def execute_sandboxed_code(user_code: str):
    """
    Executes user-provided code in a restricted sandbox that prevents
    network access and other dangerous operations. This represents the
    fix for the vulnerability.
    """
    # Create a dictionary of safe built-in functions.
    # We start with a copy of the default builtins and then remove/replace
    # dangerous ones.
    safe_builtins = sys.modules['builtins'].__dict__.copy()

    # 1. Replace the default importer with our secure version.
    # This is the primary fix to prevent importing networking modules.
    safe_builtins['__import__'] = _secure_importer

    # 2. Remove other dangerous built-ins to further harden the sandbox.
    # 'open' could be used for file system access.
    # 'eval' and 'exec' could be used to escape the sandbox.
    del safe_builtins['open']
    del safe_builtins['eval']
    del safe_builtins['exec']

    # The environment for the user's code. It only has access to our
    # curated, safe built-ins.
    sandboxed_globals = {"__builtins__": safe_builtins}

    try:
        # Execute the user's code within the sandboxed environment.
        # Any attempt to import a blocked module will raise an ImportError.
        exec(user_code, sandboxed_globals)
    except Exception as e:
        # In a real application, you would log this error.
        # For this demonstration, we print it to show the fix is working.
        print(f"Execution blocked: {e}")