Patched code sample

import os
from restricted import compile_restricted
from restricted.globals import safe_builtins, safe_globals
from restricted.utility import limited_builtins

# This represents a sensitive value that could exist in the application's environment.
# In a vulnerable implementation, a user could access this.
os.environ["MAXKB_SENSITIVE_CONFIG"] = "db_user:password@host:port/database"


def execute_sandboxed_python_tool(user_code: str):
    """
    Executes user-provided Python code in a secure sandbox.
    This function represents the fix for CVE-2025-64703, where a naive
    sandbox could be bypassed. This implementation uses 'restrictedpython'
    to prevent access to sensitive modules, built-ins, and object attributes
    that could lead to information disclosure.
    """
    
    # Define a highly restricted environment for the user code.
    # We explicitly disallow access to potentially dangerous built-ins like
    # 'open', 'eval', 'exec', and '__import__'.
    # Access to object internals like `__class__`, `__globals__` is also prohibited.
    restricted_builtins = limited_builtins.copy()
    
    # We can add custom, safe functions for the tool to use.
    # For example, a function to perform a safe, specific action.
    def safe_api_call(param: str) -> str:
        # This function is safe because it controls what can be done.
        return f"Called a safe API with parameter: {param}"

    allowed_globals = {
        '__builtins__': restricted_builtins,
        '_print_': print,  # Provides a safe way to print output.
        'safe_api_call': safe_api_call
    }

    try:
        # Compile the user code in restricted mode. This will raise a
        # SyntaxError if the code uses disallowed constructs like `import`.
        byte_code = compile_restricted(
            user_code,
            filename='<user_tool_code>',
            mode='exec'
        )

        # Execute the compiled bytecode within the restricted environment.
        # The 'None' argument for locals ensures it uses a new, empty dictionary.
        exec(byte_code, allowed_globals, None)

    except Exception as e:
        # Any error during compilation or execution is caught, preventing
        # the exploit from succeeding and informing the user of the failure.
        print(f"[SANDBOX] Execution blocked or failed: {type(e).__name__}: {e}")


if __name__ == '__main__':
    # --- DEMONSTRATION OF THE FIX ---
    # The following examples show how the fixed function blocks malicious attempts.

    print("--- 1. Attempting to import 'os' to read environment variables ---")
    malicious_code_import = "import os\nprint(os.environ.get('MAXKB_SENSITIVE_CONFIG'))"
    execute_sandboxed_python_tool(malicious_code_import)
    # EXPECTED: A SyntaxError because `import` is not allowed.

    print("\n--- 2. Attempting sandbox escape via object introspection ---")
    malicious_code_introspect = """
# This payload tries to walk the object hierarchy to find the 'os' module.
for sc in ().__class__.__bases__[0].__subclasses__():
    if sc.__name__ == '_wrap_close':
        try:
            os_module = sc.__init__.__globals__['os']
            _print_("Leaked env vars:", os_module.environ)
            break
        except:
            continue
"""
    execute_sandboxed_python_tool(malicious_code_introspect)
    # EXPECTED: An error because access to `__class__` or other `__` attributes is blocked.

    print("\n--- 3. Attempting to use a disallowed builtin ('open') ---")
    malicious_code_open = "f = open('/etc/passwd', 'r')\n_print_(f.read())"
    execute_sandboxed_python_tool(malicious_code_open)
    # EXPECTED: A NameError because `open` is not in the allowed builtins.

    print("\n--- 4. Running a legitimate, safe payload ---")
    safe_code = """
a = 10
b = 21
result = (a + b) * 2
_print_(f'The safe result is: {result}')
output = safe_api_call('test_parameter')
_print_(output)
"""
    execute_sandboxed_python_tool(safe_code)
    # EXPECTED: The code runs successfully and prints the correct result.