Patched code sample

import string
from typing import Any, Dict, List, Mapping, Sequence, Tuple, Union


class SafeFormatter(string.Formatter):
    """
    A custom string formatter that prevents access to private or magic attributes.
    This is a key part of the fix for the template injection vulnerability.
    """

    def get_field(
        self, field_name: str, args: Sequence[Any], kwargs: Mapping[str, Any]
    ) -> Tuple[Any, str]:
        """
        Override to check for attempts to access protected attributes.
        This method is called for each replacement field in the template.
        """
        # Disallow access to attributes starting with an underscore.
        # This prevents access to private attributes (e.g., _private_var)
        # and magic methods (e.g., __class__).
        if any(
            part.startswith("_")
            for part in field_name.replace("[", ".").split(".")
            if part
        ):
            raise ValueError(
                f"Access to private or magic attributes is not allowed. "
                f"Attempted to access '{field_name}'."
            )
        # If the check passes, proceed with the default behavior.
        return super().get_field(field_name, args, kwargs)


class PatchedChatPromptTemplate:
    """
    A representative example of a patched prompt template class that uses the
    SafeFormatter to prevent template injection vulnerabilities.
    """

    def __init__(self, template: str):
        self.template = template
        self._formatter = SafeFormatter()

    def format(self, **kwargs: Any) -> str:
        """
        Formats the template string using the safe formatter.
        """
        return self._formatter.format(self.template, **kwargs)


# --- Demonstration of the Fix ---

# 1. Define a simple class to use as a template variable.
class User:
    def __init__(self, name: str, role: str):
        self.name = name
        self.role = role
        self._internal_id = "abc-123-internal"


# 2. Create an instance of the user.
current_user = User(name="Alice", role="admin")

# 3. Define a malicious template that tries to access a magic attribute (__class__).
malicious_template_str = "User's object type is: {user.__class__}"

# 4. Instantiate the patched template class with the malicious string.
patched_template = PatchedChatPromptTemplate(template=malicious_template_str)

print("--- Demonstrating the Fix for CVE-2025-65106 ---")
print(f"Attempting to format malicious template: '{malicious_template_str}'\n")

# 5. Attempt to format the template. This should fail due to the SafeFormatter.
try:
    patched_template.format(user=current_user)
except ValueError as e:
    print(f"SUCCESS: The vulnerability was blocked as expected.")
    print(f"Error message: {e}\n")


# 6. Define another malicious template trying to access a private attribute.
malicious_template_2_str = "User's internal ID is: {user._internal_id}"
patched_template_2 = PatchedChatPromptTemplate(template=malicious_template_2_str)
print(f"Attempting to format another malicious template: '{malicious_template_2_str}'\n")

try:
    patched_template_2.format(user=current_user)
except ValueError as e:
    print(f"SUCCESS: The vulnerability was blocked for private attributes too.")
    print(f"Error message: {e}\n")


# 7. Show that a legitimate template still works correctly.
legitimate_template_str = "User '{user.name}' has the role '{user.role}'."
patched_legit_template = PatchedChatPromptTemplate(template=legitimate_template_str)
print(f"Formatting a legitimate template: '{legitimate_template_str}'\n")

formatted_string = patched_legit_template.format(user=current_user)
print(f"SUCCESS: Legitimate formatting works as intended.")
print(f"Result: {formatted_string}")