Patched code sample

import os
import pickle
import shutil
from diskcache import Cache, JSONSerializer

# This hypothetical CVE describes a classic insecure deserialization vulnerability.
# The fix is to stop using pickle, which can execute arbitrary code, and instead
# use a safe serialization format like JSON.
#
# This code first demonstrates the vulnerability with the default pickle serializer
# and then shows how configuring a JSONSerializer fixes it.

# --- Malicious Payload Definition ---
# An attacker can craft a class that executes a command when an instance of it
# is deserialized by pickle.
class RCE:
    def __reduce__(self):
        # This function is called by pickle during deserialization.
        # It returns a callable (os.system) and its arguments.
        # This will create a file named 'pwned.txt' to prove code execution.
        cmd = ('touch pwned.txt')
        return (os.system, (cmd,))

# --- Setup for Demonstration ---
VULNERABLE_CACHE_DIR = './vulnerable_cache'
FIXED_CACHE_DIR = './fixed_cache'
PWNED_FILE = 'pwned.txt'

# Clean up previous runs
if os.path.exists(VULNERABLE_CACHE_DIR):
    shutil.rmtree(VULNERABLE_CACHE_DIR)
if os.path.exists(FIXED_CACHE_DIR):
    shutil.rmtree(FIXED_CACHE_DIR)
if os.path.exists(PWNED_FILE):
    os.remove(PWNED_FILE)

# --- 1. Simulating the Vulnerability ---

# A victim application uses DiskCache with the default, insecure settings.
vulnerable_cache = Cache(VULNERABLE_CACHE_DIR)
# The application stores some normal data.
vulnerable_cache.set('some_key', 'some_value')

# An attacker with write access to the server crafts a malicious pickle payload.
malicious_payload = pickle.dumps(RCE())

# The attacker finds the cache file on disk and overwrites it with the payload.
# We simulate this using an internal function to get the file path.
try:
    cache_file_path = vulnerable_cache._fn('some_key', write=False)
    with open(cache_file_path, 'wb') as f:
        f.write(malicious_payload)
except Exception:
    pass # Ignore errors in simulation setup

# When the victim application tries to read from the cache, the malicious
# code is executed during deserialization.
try:
    vulnerable_cache.get('some_key')
except Exception:
    # The payload might cause an exception after execution, which can be ignored.
    pass

# Verify that the vulnerability was exploited.
assert os.path.exists(PWNED_FILE), "Vulnerability demo failed."
os.remove(PWNED_FILE) # Clean up for the next step.
vulnerable_cache.close()


# --- 2. Demonstrating the Fix ---

# The FIX is to explicitly configure DiskCache to use a safe serializer
# that does not execute code, such as JSONSerializer.
fixed_cache = Cache(FIXED_CACHE_DIR, serializer=JSONSerializer())
# The application stores some JSON-serializable data.
fixed_cache.set('some_key', {'data': 'some_value'})

# The attacker tries the same attack again, overwriting the cache file
# with the same malicious pickle payload.
try:
    cache_file_path = fixed_cache._fn('some_key', write=False)
    with open(cache_file_path, 'wb') as f:
        f.write(malicious_payload)
except Exception:
    pass # Ignore errors in simulation setup

# Now, when the victim application tries to read the data, the JSONSerializer
# will fail because the data is not valid JSON. No code is executed.
try:
    fixed_cache.get('some_key')
except Exception as e:
    # A deserialization error (e.g., JSONDecodeError) is expected and proves
    # that the safe serializer prevented the attack.
    pass

# Verify that the fix worked and no malicious code was executed.
assert not os.path.exists(PWNED_FILE), "Fix failed, RCE was still executed."
fixed_cache.close()

# --- Final Cleanup ---
shutil.rmtree(VULNERABLE_CACHE_DIR)
shutil.rmtree(FIXED_CACHE_DIR)