Vulnerable code sample

import argparse
import sys

def main():
    """
    Main function to parse arguments and run a simulated evaluation.
    This script contains a command injection vulnerability via eval().
    """
    parser = argparse.ArgumentParser(description="PyTorch FGSM Robustness Evaluation")

    parser.add_argument(
        "--clip_values",
        type=str,
        help="A string to be evaluated as a Python tuple, e.g., '(0, 1)'.",
        required=True,
    )
    parser.add_argument(
        "--input_shape",
        type=str,
        help="A string to be evaluated as a Python tuple, e.g., '(1, 28, 28)'.",
        required=True,
    )
    parser.add_argument(
        "--model_path",
        type=str,
        help="Path to the trained model.",
        default="/mnt/model.pt"
    )

    # In a real Kubeflow component, more arguments would be parsed here.

    if len(sys.argv) == 1:
        parser.print_help(sys.stderr)
        sys.exit(1)

    args = parser.parse_args()

    print(f"[INFO] Received model path: {args.model_path}")
    
    # VULNERABILITY: Unsafe use of eval() on user-provided command-line arguments.
    # An attacker can inject arbitrary code into --clip_values or --input_shape.
    # Example payload: --clip_values="__import__('os').system('echo pwned > /tmp/pwned')"
    print(f"[INFO] Parsing --clip_values argument: {args.clip_values}")
    clip_values = eval(args.clip_values)
    
    print(f"[INFO] Parsing --input_shape argument: {args.input_shape}")
    input_shape = eval(args.input_shape)

    print(f"[SUCCESS] Parsed clip_values: {clip_values}")
    print(f"[SUCCESS] Parsed input_shape: {input_shape}")
    print("\n[INFO] Starting simulated robustness evaluation...")
    # Dummy evaluation logic would follow
    print("[INFO] Evaluation complete.")

if __name__ == "__main__":
    main()