Patched code sample

import subprocess

# This example represents a simplified pyLoad configuration manager and its API.
# The core of the fix is to prevent non-admin users from modifying security-critical
# configuration settings.

class ConfigManager:
    """
    A simplified representation of the configuration management system.
    """
    def __init__(self, initial_config=None):
        if initial_config is None:
            self.config = {
                "general": {"language": "en"},
                "reconnect": {"script": ""}
            }
        else:
            self.config = initial_config

    # --- Start of the fix for CVE-2026-33509 ---
    # A set of security-critical options that should only be modified by an admin.
    # This prevents users with only 'SETTINGS' permission from changing them.
    SENSITIVE_OPTIONS = {
        "reconnect.script"
        # Other security-critical options would be added here.
    }

    def set_config_value(self, section, option, value, user_permissions):
        """
        Sets a configuration value after performing security checks.

        Args:
            section (str): The configuration section (e.g., 'reconnect').
            option (str): The configuration option (e.g., 'script').
            value (str): The new value for the option.
            user_permissions (set): A set of permissions for the user (e.g., {'SETTINGS', 'ADMIN'}).

        Raises:
            PermissionError: If the user lacks the required permissions.
            ValueError: If the configuration option does not exist.
        """
        if "SETTINGS" not in user_permissions:
            raise PermissionError("User does not have 'SETTINGS' permission.")

        full_option_key = f"{section}.{option}"

        # THE FIX: Check if the option is in the sensitive list and if the user is NOT an admin.
        # Before the patch, this check did not exist, allowing a non-admin 'SETTINGS'
        # user to modify 'reconnect.script'.
        if full_option_key in self.SENSITIVE_OPTIONS and "ADMIN" not in user_permissions:
            raise PermissionError(f"Admin privileges are required to modify the sensitive option '{full_option_key}'.")

        # --- End of the fix for CVE-2026-33509 ---

        if section in self.config and option in self.config[section]:
            print(f"User with permissions {user_permissions} successfully set '{full_option_key}' to '{value}'.")
            self.config[section][option] = value
        else:
            raise ValueError(f"Configuration option '{full_option_key}' not found.")

def run_reconnect_script(config_manager):
    """
    Simulates the part of the application that uses the 'reconnect.script' config.
    """
    script_path = config_manager.config.get("reconnect", {}).get("script", "")
    if script_path:
        print(f"\nAttempting to execute reconnect script: {script_path}")
        # In a real scenario, this could be a malicious command.
        # For safety, this example will not use subprocess.run directly on the path.
        # Instead, we will just print what would have happened.
        print(f"SIMULATION: subprocess.run(['{script_path}']) would be called here.")
        # Example of the dangerous call that would have been made:
        # subprocess.run([script_path], shell=True)
    else:
        print("\nNo reconnect script is configured.")

if __name__ == '__main__':
    # DEMONSTRATION OF THE FIX

    # 1. Setup
    config_manager = ConfigManager()
    admin_user_permissions = {"SETTINGS", "ADMIN"}
    settings_only_user_permissions = {"SETTINGS"}

    print("--- Demonstrating the patched ConfigManager ---")
    print(f"Initial config: {config_manager.config}")

    # 2. Malicious attempt by a non-admin user (with only 'SETTINGS' permission)
    print("\n[ATTEMPT 1] A non-admin user tries to set 'reconnect.script' to a malicious command.")
    try:
        # This user only has 'SETTINGS', not 'ADMIN'.
        config_manager.set_config_value(
            section="reconnect",
            option="script",
            value="/usr/bin/touch /tmp/pwned",
            user_permissions=settings_only_user_permissions
        )
    except PermissionError as e:
        print(f"SUCCESSFULLY BLOCKED: {e}")

    print(f"Config after failed attempt: {config_manager.config}")
    run_reconnect_script(config_manager) # Script is not set, RCE is prevented.

    # 3. Legitimate attempt by a non-admin user to change a non-sensitive setting
    print("\n[ATTEMPT 2] A non-admin user tries to set a non-sensitive option 'general.language'.")
    try:
        config_manager.set_config_value(
            section="general",
            option="language",
            value="de",
            user_permissions=settings_only_user_permissions
        )
        print("SUCCESS: Non-sensitive setting changed.")
    except PermissionError as e:
        print(f"FAILED (UNEXPECTED): {e}")

    print(f"Config after successful change: {config_manager.config}")

    # 4. Legitimate attempt by an admin user to change the sensitive setting
    print("\n[ATTEMPT 3] An admin user legitimately sets the 'reconnect.script'.")
    try:
        config_manager.set_config_value(
            section="reconnect",
            option="script",
            value="/usr/local/bin/my_reconnect.sh",
            user_permissions=admin_user_permissions
        )
    except PermissionError as e:
        print(f"FAILED (UNEXPECTED): {e}")

    print(f"Config after admin change: {config_manager.config}")
    run_reconnect_script(config_manager) # Script is now set by an authorized user.