Patched code sample

import subprocess
import sys
import threading
import time
from http.server import BaseHTTPRequestHandler, HTTPServer

# This code demonstrates a potential fix for a vulnerability like the one
# described in the fictional CVE-2026-25904. The CVE describes an overly
# permissive Deno sandbox configuration in the "mcp-run-python" tool,
# allowing Server-Side Request Forgery (SSRF) to the localhost interface.
#
# Since the project is archived and no official fix exists, this code
# provides a representative example.
#
# The vulnerability lies in using the `--allow-net` flag without restriction,
# which allows the sandboxed code to make any network request, including
# to sensitive internal endpoints on localhost.
#
# The FIX is to completely REMOVE the `--allow-net` flag. This leverages
# Deno's secure-by-default sandbox, which denies all network access unless
# explicitly permitted. By removing the flag, we prevent the sandboxed
# code from performing any SSRF or other network-based attacks.

# --- Helper code to simulate a sensitive local server ---

class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):
    """A simple handler that simulates a sensitive internal API."""
    def do_GET(self):
        if self.path == '/internal/api/secret':
            self.send_response(200)
            self.send_header('Content-type', 'application/json')
            self.end_headers()
            self.wfile.write(b'{"user": "admin", "secret_key": "sensitive-data"}')
        else:
            self.send_response(404)
            self.end_headers()
            self.wfile.write(b'{"error": "Not Found"}')

def run_mock_server(server_class=HTTPServer, handler_class=SimpleHTTPRequestHandler, port=8888):
    """Runs a simple HTTP server in a separate thread."""
    server_address = ('127.0.0.1', port)
    httpd = server_class(server_address, handler_class)
    print(f"Starting mock sensitive server on http://127.0.0.1:{port}...")
    httpd.serve_forever()

# --- Vulnerable vs. Fixed Functions ---

def run_in_deno_sandbox_vulnerable(untrusted_code: str):
    """
    VULNERABLE IMPLEMENTATION:
    Simulates the original vulnerability by using an overly permissive
    '--allow-net' flag, enabling SSRF attacks to localhost.
    """
    command = [
        "deno",
        "run",
        "--quiet",
        "--allow-net",  # VULNERABILITY: Allows any network access
        "-",
    ]
    try:
        process = subprocess.run(
            command,
            input=untrusted_code.encode('utf-8'),
            capture_output=True,
            text=True,
            timeout=5
        )
        return process.stdout, process.stderr
    except FileNotFoundError:
        return "", "Error: 'deno' command not found. Please install Deno."
    except subprocess.TimeoutExpired:
        return "", "Error: Deno process timed out."


def run_in_deno_sandbox_fixed(untrusted_code: str):
    """
    FIXED IMPLEMENTATION:
    The fix is to remove the '--allow-net' flag entirely. Deno's sandbox
    is secure by default and will deny any network-related I/O,
    effectively preventing SSRF attacks.
    """
    command = [
        "deno",
        "run",
        "--quiet",
        # FIX: The '--allow-net' flag is removed. Network access is now denied.
        "-",
    ]
    try:
        process = subprocess.run(
            command,
            input=untrusted_code.encode('utf-8'),
            capture_output=True,
            text=True,
            timeout=5
        )
        return process.stdout, process.stderr
    except FileNotFoundError:
        return "", "Error: 'deno' command not found. Please install Deno."
    except subprocess.TimeoutExpired:
        return "", "Error: Deno process timed out."


# --- Demonstration ---

if __name__ == "__main__":
    # Untrusted code attempting an SSRF attack to a local endpoint
    ssrf_attack_code = """
    // This untrusted code tries to access a sensitive local server.
    try {
        const response = await fetch('http://127.0.0.1:8888/internal/api/secret');
        const data = await response.json();
        console.log(JSON.stringify(data));
    } catch (e) {
        console.error(e.toString());
    }
    """

    # Start the mock sensitive server in the background
    server_port = 8888
    server_thread = threading.Thread(target=run_mock_server, args=(HTTPServer, SimpleHTTPRequestHandler, server_port))
    server_thread.daemon = True
    server_thread.start()
    time.sleep(1) # Give server time to start

    print("-" * 50)
    print("Demonstrating the FIXED implementation...")
    print("Executing untrusted code that attempts an SSRF attack.")
    print("-" * 50)

    # Use the FIXED function
    stdout, stderr = run_in_deno_sandbox_fixed(ssrf_attack_code)

    if "'deno' command not found" in stderr:
        print(stderr, file=sys.stderr)
        sys.exit(1)

    print(f"STDOUT:\n{stdout or 'None'}")
    print(f"STDERR:\n{stderr or 'None'}")

    print("-" * 50)
    if "PermissionDenied: network access" in stderr:
        print("✅ SUCCESS: The fix worked.")
        print("The Deno sandbox correctly blocked the network request to localhost, preventing the SSRF attack.")
    else:
        print("❌ FAILURE: The fix did not work as expected.")
        print("The untrusted code may have been able to perform the network request.")

    # The server runs in a daemon thread, so the script will exit automatically.