Patched code sample

import ast
import pandas as pd

class DisallowedCodeException(Exception):
    pass

class SafeExecutor:
    """
    Represents a sandboxed execution environment that validates Python code
    by inspecting its Abstract Syntax Tree (AST) before execution.
    """
    def _check_ast_node(self, node):
        # Disallow imports
        if isinstance(node, (ast.Import, ast.ImportFrom)):
            raise DisallowedCodeException("Imports are forbidden.")
        # Disallow accessing attributes starting with '__' (e.g., __subclasses__)
        if isinstance(node, ast.Attribute) and node.attr.startswith('__'):
            raise DisallowedCodeException("Accessing dunder attributes is forbidden.")
        # Disallow calls to dangerous built-in functions
        if (isinstance(node, ast.Call) and
            hasattr(node.func, 'id') and
            node.func.id in ('eval', 'exec', 'open', '__import__')):
            raise DisallowedCodeException(f"Call to forbidden function '{node.func.id}' is not allowed.")

    def execute(self, code: str, local_scope: dict):
        try:
            tree = ast.parse(code, mode='exec')
            for node in ast.walk(tree):
                self._check_ast_node(node)
            # Execute the code only after validation, with restricted globals.
            exec(code, {'__builtins__': {}}, local_scope)
        except Exception as e:
            # Propagate exceptions as execution failures.
            raise RuntimeError(f"Sandboxed execution failed: {e}") from e

class CSV_Agents:
    """
    This class represents the fixed version. The vulnerability existed in the 'run'
    method, which previously used a direct, unsafe evaluation of LLM-generated code.
    """
    def __init__(self):
        self._safe_executor = SafeExecutor()
        # In a real scenario, this dataframe would be loaded from a user's CSV.
        self.dataframe = pd.DataFrame()

    def run(self, llm_generated_python_script: str):
        """
        The fixed 'run' method delegates execution to a safe, sandboxed environment.
        It no longer uses a direct `eval()` or `exec()` on untrusted input.
        """
        # The local scope provided to the executor contains the dataframe and a
        # placeholder for the result.
        execution_scope = {'df': self.dataframe, 'result': None}
        try:
            self._safe_executor.execute(llm_generated_python_script, execution_scope)
            return execution_scope['result']
        except RuntimeError as e:
            # If sandboxed execution fails (e.g., due to disallowed code),
            # return a safe error message instead of executing the malicious command.
            return f"Execution blocked by sandbox. Reason: {e}"