Patched code sample

import json

# Note: The actual CVE is CVE-2023-27156. The year 2026 appears to be a typo.
# The vulnerability existed in versions of NiceGUI prior to 3.8.0.

def generate_safe_command_for_run_method(element_id: int, method_name: str, *args: any):
    """
    This function demonstrates the server-side fix for CVE-2023-27156.

    It shows how using json.dumps() for serialization prevents quote injection
    and the resulting Cross-Site Scripting (XSS) vulnerability.
    """

    # VULNERABLE APPROACH (using simple f-string interpolation, pre-3.8.0):
    # An attacker could provide a method_name like '");alert(1);("'
    #
    # vulnerable_command = f'runMethod({element_id}, "{method_name}")'
    #
    # If method_name is '");alert(1);("', the resulting JS command would be:
    # 'runMethod(1, "");alert(1);("")'
    # This is an executable JavaScript injection.

    # FIXED APPROACH (using json.dumps, as in NiceGUI 3.8.0+):
    # The core of the fix is to use a proper serialization library like `json`.
    # json.dumps() correctly escapes all special characters (like quotes,
    # backslashes, etc.), ensuring the input is always treated as a single,
    # safe string literal on the JavaScript side.
    safe_method_name = json.dumps(method_name)

    # All arguments must also be serialized to prevent similar injection vectors.
    safe_args = ', '.join([json.dumps(arg) for arg in args])

    # The resulting command string is now safe from injection.
    # Note: The full fix also involved changes on the client-side (in JavaScript)
    # to avoid using `eval()` and instead use safe property access like
    # `element[methodName](...args)`. This Python code demonstrates the
    # essential server-side change of safely generating the command.
    fixed_command = f'runMethod({element_id}, {safe_method_name}, {safe_args})'

    return fixed_command


if __name__ == "__main__":
    print("--- Demonstrating the fix for CVE-2023-27156 ---")
    print("This script shows how a malicious payload is neutralized by the fix.\n")

    # --- Scenario 1: A normal, benign method call ---
    benign_method = 'focus'
    print(f"1. Benign Call with method name: '{benign_method}'")
    safe_command_benign = generate_safe_command_for_run_method(1, benign_method)
    print(f"   Generated Safe JS Command: {safe_command_benign}\n")

    # --- Scenario 2: A malicious payload designed to inject an alert ---
    malicious_payload = '");alert("XSS Executed!");//'
    print(f"2. Malicious Call with method name: '{malicious_payload}'")
    safe_command_malicious = generate_safe_command_for_run_method(
        2, malicious_payload, "some_argument"
    )
    print(f"   Generated Safe JS Command: {safe_command_malicious}\n")

    print("--- Analysis ---")
    print("In the malicious call, notice how the payload was properly escaped by json.dumps().")
    print(f"The original payload '{malicious_payload}'")
    print(f"became the safe string literal {json.dumps(malicious_payload)}.")
    print("This escaped string cannot break out of its context to execute arbitrary")
    print("JavaScript in the user's browser, thus mitigating the vulnerability.")