Vulnerable code sample

import yaml

# This function simulates the vulnerable part of the BentoML containerize process
# before the fix. It reads a configuration, extracts the 'system_packages' list,
# and directly interpolates it into a Dockerfile 'RUN' command without sanitization.

def generate_vulnerable_dockerfile_string(config_dict):
    """
    Generates a Dockerfile string from a config dictionary, demonstrating
    the command injection vulnerability in the 'system_packages' field.
    """
    docker_config = config_dict.get("docker", {})
    system_packages = docker_config.get("system_packages", [])

    # The vulnerable operation: Joining package names into a single string
    # without any validation or sanitization.
    packages_to_install_str = " ".join(system_packages)

    # The resulting string is then injected directly into a shell command.
    dockerfile_template = f"""
FROM python:3.9-slim

# This RUN command is vulnerable to command injection.
# An attacker can add shell commands separated by ';' or '&&'.
RUN apt-get update && apt-get install -y --no-install-recommends {packages_to_install_str}

# ... rest of the Dockerfile generation
"""
    return dockerfile_template

# --- Demonstration ---

# This string represents a malicious 'bentofile.yaml' content.
# The second "package" is actually a shell command to be injected.
malicious_yaml_content = """
service: "my_service.py:svc"
docker:
  system_packages:
    - "git"
    - "; touch /tmp/pwned; echo 'Vulnerable!'"
"""

# Simulate parsing the YAML file.
parsed_malicious_config = yaml.safe_load(malicious_yaml_content)

# Generate the Dockerfile using the vulnerable logic.
generated_dockerfile = generate_vulnerable_dockerfile_string(parsed_malicious_config)

# Print the generated Dockerfile to show the injected command.
# When this Dockerfile is built, the command `touch /tmp/pwned` will be executed.
print("--- Generated Dockerfile with Injected Command ---")
print(generated_dockerfile)