Patched code sample

import ast

def safe_load_functions(code_string: str) -> dict:
    """
    Safely loads Python functions from a string by first parsing it into an
    Abstract Syntax Tree (AST) and ensuring it only contains function definitions.
    This prevents the execution of arbitrary code.
    """
    try:
        tree = ast.parse(code_string)
    except SyntaxError as e:
        raise ValueError(f"Invalid Python syntax: {e}")

    # Verify that the code block only contains function definitions.
    for node in tree.body:
        if not isinstance(node, ast.FunctionDef):
            raise ValueError(
                "Provided code is not safe: only 'def' statements are allowed."
            )

    # If all nodes are function definitions, it's safe to execute.
    scope = {}
    exec(code_string, {}, scope)
    return scope

# --- Example Usage ---

# 1. A valid string containing only a function definition.
# This will succeed.
safe_code = """
def get_current_weather(location: str, unit: str = "celsius"):
    \"\"\"Gets the current weather in a given location.\"\"\"
    # In a real scenario, this would call an API.
    if "tokyo" in location.lower():
        return f"The weather in Tokyo is 15 degrees {unit}"
    return f"Weather for {location} is not available."
"""

# 2. A malicious string attempting to execute arbitrary code.
# This will fail with a ValueError.
malicious_code = "__import__('os').system('echo PWNED')"

# 3. Another malicious example, hiding the call inside a valid-looking structure.
# This will also fail with a ValueError.
malicious_code_2 = """
import os
def a_function():
    os.system('echo still pwned')
"""

if __name__ == '__main__':
    print("--- Testing safe code ---")
    try:
        loaded_functions = safe_load_functions(safe_code)
        print("Successfully loaded functions:")
        print(list(loaded_functions.keys()))
        # Example of calling the loaded function
        weather_func = loaded_functions['get_current_weather']
        print(weather_func(location="Tokyo"))
    except ValueError as e:
        print(f"Failed to load safe code: {e}")


    print("\n--- Testing malicious code 1 ---")
    try:
        safe_load_functions(malicious_code)
    except ValueError as e:
        print(f"Successfully blocked malicious code: {e}")

    print("\n--- Testing malicious code 2 (with import) ---")
    try:
        safe_load_functions(malicious_code_2)
    except ValueError as e:
        print(f"Successfully blocked malicious code: {e}")