Patched code sample

import json
import os

# A simple representation of a molecule data structure.
# In a real application, this would be more complex.
class Molecule:
    def __init__(self, name, formula, atomic_masses):
        if not isinstance(name, str) or not name:
            raise ValueError("Molecule name must be a non-empty string.")
        if not isinstance(formula, str) or not formula:
            raise ValueError("Molecule formula must be a non-empty string.")
        if not isinstance(atomic_masses, dict):
            raise ValueError("Atomic masses must be a dictionary.")

        self.name = name
        self.formula = formula
        self.atomic_masses = atomic_masses

    def __repr__(self):
        return f"Molecule(name='{self.name}', formula='{self.formula}')"

# --- VULNERABLE CODE (REPRESENTATIVE EXAMPLE) ---
# The original insecure code would have used pickle without validation,
# allowing for arbitrary code execution.
#
# import pickle
#
# def load_molecule_vulnerable(filepath):
#     """
#     VULNERABLE: Deserializes data from a file using pickle.
#     An attacker could craft a file that executes arbitrary code upon loading.
#     """
#     with open(filepath, 'rb') as f:
#         # This is the vulnerable call.
#         return pickle.load(f)

# --- FIXED CODE ---

def save_molecule_secure(molecule, filepath):
    """
    Saves molecule data to a file using the secure JSON format.
    """
    if not isinstance(molecule, Molecule):
        raise TypeError("Object to be saved must be a Molecule instance.")
    
    data = {
        "name": molecule.name,
        "formula": molecule.formula,
        "atomic_masses": molecule.atomic_masses
    }
    with open(filepath, 'w') as f:
        json.dump(data, f, indent=2)

def load_molecule_secure(filepath):
    """
    FIXED: Deserializes molecule data from a file using JSON.
    It performs validation to ensure the data conforms to the expected structure
    before creating a Molecule object, preventing deserialization attacks.
    """
    if not os.path.exists(filepath):
        raise FileNotFoundError(f"No such file: '{filepath}'")

    with open(filepath, 'r') as f:
        try:
            data = json.load(f)
        except json.JSONDecodeError as e:
            raise ValueError(f"Invalid JSON format in {filepath}: {e}")

    # 1. Validate that the loaded data is a dictionary
    if not isinstance(data, dict):
        raise TypeError(f"Expected data to be a dictionary, but got {type(data).__name__}")

    # 2. Validate the presence and type of required keys
    required_keys = ["name", "formula", "atomic_masses"]
    for key in required_keys:
        if key not in data:
            raise ValueError(f"Missing required key in molecule data: '{key}'")

    # 3. Construct the object from validated data, allowing the class's
    #    own __init__ validation to run as a final check.
    try:
        molecule = Molecule(
            name=data["name"],
            formula=data["formula"],
            atomic_masses=data["atomic_masses"]
        )
        return molecule
    except (ValueError, TypeError) as e:
        # Catches validation errors from the Molecule.__init__ method
        raise ValueError(f"Data in {filepath} is invalid for Molecule object: {e}")


if __name__ == '__main__':
    # --- DEMONSTRATION OF THE FIX ---
    
    # 1. Create a legitimate molecule object and save it securely.
    water = Molecule(
        name="Water",
        formula="H2O",
        atomic_masses={"H": 1.008, "O": 15.999}
    )
    safe_filepath = "water.json"
    save_molecule_secure(water, safe_filepath)
    print(f"Saved '{water.name}' to '{safe_filepath}'")

    # 2. Load the molecule back using the secure function.
    try:
        loaded_molecule = load_molecule_secure(safe_filepath)
        print(f"Successfully loaded molecule: {loaded_molecule}")
        assert loaded_molecule.name == "Water"
        assert loaded_molecule.formula == "H2O"
    except (ValueError, TypeError, FileNotFoundError) as e:
        print(f"Error loading molecule: {e}")

    print("-" * 20)

    # 3. Demonstrate failure with a malformed/malicious file.
    # This file is missing the 'formula' key.
    malicious_data = '{"name": "Incomplete Molecule", "atomic_masses": {}}'
    malicious_filepath = "malicious.json"
    with open(malicious_filepath, 'w') as f:
        f.write(malicious_data)
    
    print(f"Attempting to load from '{malicious_filepath}'...")
    try:
        load_molecule_secure(malicious_filepath)
    except ValueError as e:
        print(f"Correctly caught error: {e}")
        print("The secure loader prevented an invalid object from being created.")
    
    # Clean up the created files
    os.remove(safe_filepath)
    os.remove(malicious_filepath)