Patched code sample

import flask
import json

# The CVE number CVE-2026-26216 is hypothetical as of this writing.
# This code demonstrates a fix for the described vulnerability type.
# The vulnerability involved executing user-provided code from a 'hooks'
# parameter using exec() with the '__import__' builtin available, allowing
# attackers to import modules like 'os' or 'subprocess' to execute
# system commands.

# The fix is to provide a severely restricted environment to the exec()
# call, specifically by creating a whitelist of safe built-in functions
# and excluding '__import__'.

app = flask.Flask(__name__)

# This is the core of the fix: A whitelist of functions considered safe.
# Crucially, it does NOT include '__import__', 'open', 'eval', 'exec', etc.
# An attacker attempting to call `__import__('os').system('...')` will
# receive a NameError because '__import__' is not defined in this scope.
SAFE_BUILTINS = {
    'print': print,
    'len': len,
    'str': str,
    'int': int,
    'float': float,
    'bool': bool,
    'list': list,
    'dict': dict,
    'set': set,
    'tuple': tuple,
    'range': range,
    'abs': abs,
    'min': min,
    'max': max,
    'sum': sum,
    'sorted': sorted,
}

@app.route('/crawl', methods=['POST'])
def crawl():
    """
    A mock endpoint demonstrating the fixed code execution environment.
    """
    try:
        data = flask.request.get_json()
        if not data:
            return flask.Response("Invalid JSON", status=400)

        hooks_code = data.get('hooks')

        if hooks_code:
            # Create a dictionary for the 'globals' argument of exec().
            # By setting '__builtins__', we replace the default built-in
            # functions with our own restricted, safe dictionary.
            restricted_globals = {"__builtins__": SAFE_BUILTINS}

            # Execute the user-provided code in a restricted environment.
            # The 'globals' are replaced with our safe ones, and 'locals' is empty.
            # An attack payload like "__import__('os').system('ls')" would fail here.
            exec(hooks_code, restricted_globals, {})

        # The rest of the original crawl logic would go here.
        # For demonstration, we'll just return a success message.
        return flask.Response(
            json.dumps({"status": "Crawl finished, hook executed safely."}),
            status=200,
            mimetype='application/json'
        )

    except NameError as e:
        # This is the expected error if an attacker tries to use a forbidden function.
        return flask.Response(
            f"Execution failed: A forbidden function was used. Details: {e}",
            status=403
        )
    except Exception as e:
        return flask.Response(f"An unexpected error occurred: {e}", status=500)

if __name__ == '__main__':
    # To test the fix, you can run this Flask app and send a POST request.
    #
    # 1. A safe, allowed operation:
    # curl -X POST -H "Content-Type: application/json" \
    #      -d '{"hooks": "print(\"Hook is running! Length of [1,2,3] is\", len([1,2,3]))"}' \
    #      http://127.0.0.1:5000/crawl
    #
    # 2. A malicious, blocked operation:
    # curl -X POST -H "Content-Type: application/json" \
    #      -d '{"hooks": "__import__(\"os\").system(\"echo pwned > /tmp/pwned.txt\")"}' \
    #      http://127.0.0.1:5000/crawl
    #
    # The second request will fail with a 403 Forbidden error because '__import__'
    # is not in the SAFE_BUILTINS whitelist.

    app.run(host='0.0.0.0', port=5000)