Patched code sample

import shlex
from html import escape
from typing import Dict, List


def generate_report_context_with_fix(metadata: Dict[str, any]) -> Dict[str, any]:
    """
    This function demonstrates the fix for the XSS vulnerability CVE-2024-32722
    in Memray.

    The vulnerability was caused by rendering raw command-line arguments into an
    HTML report. An attacker could provide a malicious string as a command-line
    argument, which would be executed as JavaScript when the report was viewed.

    The fix involves escaping the command-line string before it is embedded in
    the report. This function simulates that process.

    Args:
        metadata: A dictionary containing report metadata, including a
                  'command_line' key with a list of arguments.

    Returns:
        A dictionary of context data ready for safe HTML rendering.
    """
    command_line_args: List[str] = metadata.get("command_line", [])

    # VULNERABLE IMPLEMENTATION (for conceptual reference):
    #
    #   vulnerable_command_line = " ".join(command_line_args)
    #   context = {"command_line": vulnerable_command_line}
    #
    # If an argument was "<script>alert('XSS')</script>", the string would be
    # injected directly into the HTML, causing the script to execute.

    # FIXED IMPLEMENTATION:
    # The command-line arguments are joined, and then the entire string is
    # passed to `html.escape()`. This converts special HTML characters
    # (like '<', '>', '&') into their safe entity equivalents (e.g., '<',
    # '>', '&').
    safe_command_line = escape(" ".join(command_line_args))

    # The resulting context contains a string that is safe to be rendered
    # in an HTML document.
    return {
        "command_line": safe_command_line,
        "pid": metadata.get("pid"),
        # ... other metadata would be included here
    }


if __name__ == '__main__':
    # --- DEMONSTRATION ---

    # 1. Metadata with a malicious payload in the command line
    malicious_metadata = {
        "pid": 12345,
        "command_line": [
            "python",
            "my_app.py",
            "--user-input",
            "<script>alert('This script executes if not escaped!')</script>"
        ]
    }

    # 2. Generate the report context using the fixed function
    safe_context = generate_report_context_with_fix(malicious_metadata)

    # 3. Show the output. The malicious script is now harmless text.
    print("Original malicious argument: ", malicious_metadata["command_line"][-1])
    print("\nSafely escaped command line for HTML report:")
    print(safe_context["command_line"])

    # The output shows that '<script>' has been converted to '<script>',
    # which browsers will display as text instead of executing as code.
    #
    # EXPECTED OUTPUT:
    # python my_app.py --user-input <script>alert('This script executes if not escaped!')</script>