Patched code sample

import sys
from RestrictedPython import compile_restricted
from RestrictedPython.Guards import safe_builtins

def execute_patched_script_runner(untrusted_script_source):
    """
    This function represents the patched script execution logic in OpenC3 COSMOS.
    It uses RestrictedPython to create a safe sandbox, preventing the executed
    script from accessing the network or filesystem, thus mitigating the
    vulnerability.
    """
    # Define a safe environment for the script to run in.
    # `safe_builtins` excludes dangerous functions like `__import__` and `open`.
    # This prevents the script from importing modules like 'redis' or 'socket'.
    restricted_globals = {
        "__builtins__": safe_builtins,
        "print": print  # Explicitly allow the print function for output
    }

    print("--- [Patched Runner] Attempting to execute user script... ---")
    try:
        # Compile the untrusted code in a restricted mode.
        # This will fail if the code uses syntax or features not allowed.
        byte_code = compile_restricted(
            untrusted_script_source,
            filename='<user_script>',
            mode='exec'
        )

        # Execute the compiled bytecode within the restricted environment.
        exec(byte_code, restricted_globals, None)

        print("--- [Patched Runner] Script finished execution. ---")

    except NameError as e:
        # The 'import redis' statement fails because '__import__' is not available
        # in the restricted environment, raising a NameError. This is the fix.
        print(f"--- [Patched Runner] BLOCKED UNSAFE OPERATION: {e} ---")
        print("--- [Patched Runner] The script was denied access to unauthorized modules. ---")
    except Exception as e:
        print(f"--- [Patched Runner] An unexpected error occurred: {type(e).__name__}: {e} ---")


if __name__ == '__main__':
    # This malicious script represents the exploit for CVE-2023-42088.
    # It attempts to import the 'redis' library to connect to an internal
    # database service, which should not be accessible.
    malicious_script = """
print("[User Script] Attempting to import 'redis' library...")
import redis
print("[User Script] Connecting to internal Redis DB at 'redis:6379'...")
r = redis.Redis(host='redis', port=6379)
r.set('config_key', 'hacked_value')
print("[User Script] Successfully modified data in Redis!")
"""
    # In a vulnerable system, the above script would execute successfully.
    # The patched runner prevents this.
    execute_patched_script_runner(malicious_script)