Patched code sample

import json

class Airtable_Agents:
    """
    This example represents a fix for a hypothetical code execution vulnerability.

    The vulnerable version would have used `exec()` or `eval()` on a string
    of Python code returned by an LLM.

    The fixed version below replaces arbitrary code execution with a safe
    "tool-use" pattern. The LLM is instructed to return a JSON object
    specifying a predefined, safe function to call, rather than code to execute.
    """

    def __init__(self):
        # A safelist (allow-list) of predefined, safe functions.
        # Only functions mapped in this dictionary can be called.
        self.available_tools = {
            "get_records": self.get_records,
            "add_record": self.add_record,
        }
        # A real implementation would initialize a safe Airtable client here.
        # self.airtable_client = ...

    def get_records(self, table_name: str, **kwargs):
        """A predefined, safe function to get records."""
        # In a real implementation, this would contain validated logic
        # to call the Airtable API and retrieve records.
        # print(f"SAFE ACTION: Getting records from table: {table_name}")
        return {"status": "success", "data": []}

    def add_record(self, table_name: str, data: dict, **kwargs):
        """A predefined, safe function to add a record."""
        # In a real implementation, this would contain validated logic
        # to call the Airtable API and create a record.
        # print(f"SAFE ACTION: Adding record to {table_name} with data: {data}")
        return {"status": "success", "record_id": "recNew12345"}

    def run(self, llm_output: str):
        """
        Processes the LLM's output in a safe manner.

        Instead of executing the LLM output as a script, this method
        parses it as a JSON tool call and dispatches it to a safelisted function.
        """
        try:
            # 1. Safely parse the LLM's output as JSON.
            tool_call = json.loads(llm_output)
            action_name = tool_call.get("action")
            action_params = tool_call.get("params", {})
        except (json.JSONDecodeError, AttributeError):
            return "Error: LLM output was not a valid JSON tool call."

        # 2. THE FIX: Validate the requested action against the safelist.
        # If an attacker tricks the LLM into returning a malicious action like
        # `{"action": "__import__('os').system", "params": {"command": "rm -rf /"}}`,
        # this check will prevent it from being executed.
        if action_name in self.available_tools:
            tool_function = self.available_tools[action_name]
            try:
                # 3. Execute the safelisted function with the provided parameters.
                return tool_function(**action_params)
            except TypeError as e:
                return f"Error: Invalid parameters for action '{action_name}': {e}"
        else:
            # 4. Deny execution if the action is not in the safelist.
            return f"Error: Action '{action_name}' is not a valid tool. Execution denied."