Patched code sample

import pandas as pd
import operator

# Represents data that could be pulled from a source like Airtable
data = {'product': ['Apple', 'Banana', 'Carrot', 'Donut'], 'calories': [95, 105, 25, 452], 'protein': [0.5, 1.3, 0.9, 4.9]}
df = pd.DataFrame(data)

# An allow-list of safe operators to prevent arbitrary function execution.
# The vulnerable version might have used eval() or a similar method that
# could execute any code passed in the 'op_str'.
ALLOWED_OPERATORS = {
    '>': operator.gt,
    '<': operator.lt,
    '==': operator.eq,
    '!=': operator.ne,
    '>=': operator.ge,
    '<=': operator.le
}

def execute_safe_query(column: str, op_str: str, value: any):
    """
    This function represents the fixed, secure way to query a DataFrame.
    It validates all inputs before constructing the query, preventing RCE.
    """
    # 1. FIX: Validate that the requested column exists in the DataFrame.
    # This prevents accessing unintended attributes or methods.
    if column not in df.columns:
        raise ValueError(f"Error: Column '{column}' not found.")

    # 2. FIX: Validate that the requested operator is in a predefined safe list.
    # This is the core of the fix, preventing arbitrary code from being executed.
    if op_str not in ALLOWED_OPERATORS:
        raise ValueError(f"Error: Operator '{op_str}' is not allowed.")

    # 3. FIX: Use the validated components to safely build the query.
    # No part of the user input is ever executed as code. It is only used as data
    # (column name, a key for a dictionary, and a value for comparison).
    op_func = ALLOWED_OPERATORS[op_str]
    
    try:
        # Ensure the value can be compared with the column's data type
        col_type = df[column].dtype
        typed_value = col_type.type(value)
        return df[op_func(df[column], typed_value)]
    except (ValueError, TypeError):
        raise TypeError(f"Error: Value '{value}' is not compatible with column '{column}'.")

# --- Example Usage Representing the Fixed Flow ---

# A legitimate query, parsed from a user's question.
# For example: "show products where calories are more than 100"
safe_column = 'calories'
safe_op = '>'
safe_value = 100

# This call succeeds because all inputs are valid.
safe_result = execute_safe_query(safe_column, safe_op, safe_value)


# A hypothetical malicious input. In the vulnerable version, this might have
# been injected directly into a code string for evaluation.
# For example: user_input = "calories > 0); __import__('os').system('ls');"
# The fixed approach parses the input into components first.
malicious_column_attempt = "calories"
malicious_op_attempt = "==" # A valid operator must be used to pass the op check
malicious_value_attempt = "0); __import__('os').system('echo pwned'); ("

try:
    # This call will fail safely with a TypeError during value conversion,
    # as the malicious string cannot be converted to an integer for comparison.
    # The malicious code is never executed.
    execute_safe_query(
        malicious_column_attempt,
        malicious_op_attempt,
        malicious_value_attempt
    )
except (ValueError, TypeError) as e:
    # The error demonstrates the vulnerability was blocked.
    pass