Vulnerable code sample

from functools import wraps
from flask import Flask, request, jsonify, session

# This is a simplified example using Flask to demonstrate the logical flaw.
# It does not use pyLoad's actual source code but mimics the vulnerable pattern.

app = Flask(__name__)
app.secret_key = 'vulnerable_secret_key'  # Required for session management

# Simulate a user database
USERS_DB = {
    'test_admin': {'password': 'password', 'role': 'admin', 'permissions': ['all']}
}

def requires_permission(permission):
    """Decorator to check permissions based on the session cache."""
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            # VULNERABILITY: Permissions are checked from the session cache.
            # This cache is only created at login and is not updated if the
            # user's permissions are changed in the database mid-session.
            if permission not in session.get('permissions', []):
                return jsonify({'error': 'Permission denied'}), 403
            return f(*args, **kwargs)
        return decorator
    return decorator

@app.route('/login', methods=['POST'])
def login():
    """Logs a user in and caches their role and permissions in the session."""
    data = request.json
    username = data.get('username')
    password = data.get('password')
    user = USERS_DB.get(username)

    if user and user['password'] == password:
        # User's role and permissions are read from the DB and stored in the session.
        # This is the only time they are fetched from the source of truth (the DB).
        session['username'] = username
        session['role'] = user['role']
        session['permissions'] = user['permissions']
        return jsonify({
            'message': f'Login successful for {username}.',
            'session_role': session['role'],
            'session_permissions': session['permissions']
        })
    return jsonify({'error': 'Invalid credentials'}), 401

@app.route('/admin/revoke_permissions', methods=['POST'])
@requires_permission('all') # This action itself requires high privileges
def revoke_permissions():
    """
    Simulates an admin revoking permissions for a user.
    This action only modifies the backend 'database'.
    """
    data = request.json
    target_username = data.get('username')
    if target_username in USERS_DB:
        # VULNERABLE BEHAVIOR: The user's permissions are changed in the database,
        # but the active session for that user is not updated or invalidated.
        # The logged-in user will retain their old permissions until they log out.
        USERS_DB[target_username]['role'] = 'user'
        USERS_DB[target_username]['permissions'] = []
        return jsonify({
            'message': f"Permissions for '{target_username}' have been revoked in the database."
        })
    return jsonify({'error': 'User not found'}), 404

@app.route('/admin/sensitive_action', methods=['GET'])
@requires_permission('all')
def sensitive_action():
    """
    A sensitive action that should only be accessible to users with 'all' permission.
    Due to the vulnerability, a user whose permissions have been revoked can still
    access this endpoint using their old session.
    """
    return jsonify({
        'status': 'Success',
        'message': 'Sensitive admin action executed.',
        'user_from_session': session.get('username'),
        'permissions_from_session': session.get('permissions')
    })