Patched code sample

import ast
import sys

# A simplified representation of the plugin system from PySpector.
# This code demonstrates the fix for the validation bypass.

# List of function calls considered dangerous and should be blocked.
DANGEROUS_CALLS = {
    'os.system',
    'os.popen',
    'subprocess.run',
    'subprocess.call',
    'subprocess.check_call',
    'subprocess.check_output',
    'eval',
    'exec',
}

def resolve_name(node):
    """
    Recursively resolves the full name of a function call from an AST node.
    This is the patched version of the function.
    """
    if isinstance(node, ast.Name):
        return node.id
    if isinstance(node, ast.Attribute):
        # Recursively resolve the object part of the attribute, e.g., 'os' in 'os.system'
        base = resolve_name(node.value)
        if base:
            return f"{base}.{node.attr}"
    # --- START OF THE FIX ---
    # The original vulnerability was that ast.Call was not handled, returning None.
    # The fix is to add logic to handle ast.Call nodes, specifically for 'getattr'.
    elif isinstance(node, ast.Call):
        # Check if the function being called is 'getattr'
        func_name = resolve_name(node.func)
        if func_name == 'getattr' and len(node.args) == 2:
            # The first argument to getattr is the object (e.g., os)
            obj_name = resolve_name(node.args[0])
            # The second argument is the attribute name as a string (e.g., 'system')
            # In Python 3.8+, string literals are ast.Constant. Before that, ast.Str.
            if isinstance(node.args[1], (ast.Constant, ast.Str)):
                attr_name = node.args[1].value if isinstance(node.args[1], ast.Constant) else node.args[1].s
                if obj_name and isinstance(attr_name, str):
                    # Reconstruct the full name, e.g., "os.system"
                    return f"{obj_name}.{attr_name}"
    # --- END OF THE FIX ---

    # If the name cannot be resolved, return None. The original code did this
    # for ast.Call, which caused the bypass.
    return None

class CallVisitor(ast.NodeVisitor):
    """
    An AST visitor that finds all function calls and checks them against a blocklist.
    """
    def __init__(self):
        self.dangerous_calls_found = []

    def visit_Call(self, node):
        # For each call, try to resolve its full name
        full_name = resolve_name(node.func)
        if full_name and full_name in DANGEROUS_CALLS:
            self.dangerous_calls_found.append(full_name)
        # Continue traversing the AST
        self.generic_visit(node)

def validate_plugin_code(code_string: str) -> bool:
    """
    Performs static analysis on plugin code to check for dangerous API calls.
    Returns True if the code is safe, False otherwise.
    """
    print(f"--- Validating code ---\n{code_string.strip()}\n-----------------------")
    try:
        tree = ast.parse(code_string)
        visitor = CallVisitor()
        visitor.visit(tree)

        if visitor.dangerous_calls_found:
            print(f"[!] DANGEROUS: Found blocked API calls: {', '.join(visitor.dangerous_calls_found)}")
            return False
        else:
            print("[+] SAFE: No blocked API calls were found.")
            return True
    except SyntaxError as e:
        print(f"[-] ERROR: Invalid Python syntax in plugin code: {e}")
        return False


if __name__ == '__main__':
    # This plugin code uses the exact technique described in the CVE to bypass
    # the security check. A vulnerable validator would miss this. The fixed
    # validator correctly identifies it as dangerous.
    vulnerable_plugin_code = """
import os
import subprocess

print("This plugin will try to execute a command.")
# The vulnerability: using getattr() to hide the call to os.system
# The AST node for `getattr(os, 'system')` is an `ast.Call`, which the
# vulnerable `resolve_name` function would ignore.
getattr(os, 'system')('echo "[EXEC] CVE-2026-33139 exploit successful!"')
"""

    # A plugin with a direct dangerous call, which was always caught.
    direct_dangerous_plugin_code = """
import os
os.system('echo "Direct call"')
"""

    # A safe plugin for comparison.
    safe_plugin_code = """
import os
print("This is a safe plugin.")
file_list = os.listdir('.')
print(f"Files in current directory: {len(file_list)}")
"""

    print("Demonstrating the FIXED validation logic:\n")

    print("Test 1: Analyzing a safe plugin.")
    is_safe = validate_plugin_code(safe_plugin_code)
    print(f"Validation result: {'PASSED (Code is safe)' if is_safe else 'FAILED (Code is dangerous)'}\n")

    print("Test 2: Analyzing a plugin with a direct dangerous call.")
    is_safe = validate_plugin_code(direct_dangerous_plugin_code)
    print(f"Validation result: {'PASSED (Code is safe)' if is_safe else 'FAILED (Code is dangerous)'}\n")

    print("Test 3: Analyzing the plugin that exploits the vulnerability.")
    print("A VULNERABLE validator would incorrectly label this as 'SAFE'.")
    print("The FIXED validator should correctly label it as 'DANGEROUS'.")
    is_safe = validate_plugin_code(vulnerable_plugin_code)
    print(f"Validation result: {'PASSED (Code is safe)' if is_safe else 'FAILED (Code is dangerous)'}\n")