Vulnerable code sample

import collections

# Simplified representation of user permissions
class Perms:
    SETTINGS = "SETTINGS"
    ADMIN = "ADMIN"

# Simplified representation of a user
User = collections.namedtuple('User', ['username', 'is_admin', 'permissions'])

# Simplified representation of the application's configuration
config = {
    "proxy": {
        "enabled": False,
        "host": "localhost",
        "port": 8080,
        "type": "http",
        "username": "user",
        "password": "password"
    }
}

# The hand-maintained allowlist that is missing crucial options
ADMIN_ONLY_CORE_OPTIONS = [
    ("proxy", "username"),
    ("proxy", "password"),
]

def set_config_value(user, section, option, value):
    """
    Vulnerable API method to set a configuration value.
    A non-admin user with SETTINGS permission can change sensitive
    proxy settings that are not in the ADMIN_ONLY_CORE_OPTIONS list.
    """
    if Perms.SETTINGS not in user.permissions:
        raise PermissionError("User does not have SETTINGS permission.")

    # Check if the option requires admin privileges
    if (section, option) in ADMIN_ONLY_CORE_OPTIONS:
        if not user.is_admin:
            raise PermissionError(
                f"Changing '{section}.{option}' requires admin privileges."
            )

    # VULNERABILITY:
    # No admin check is performed for other sensitive options like ("proxy", "enabled"),
    # ("proxy", "host"), or ("proxy", "port"), allowing any user with
    # SETTINGS permission to re-route all application traffic.
    if section in config and option in config[section]:
        config[section][option] = value
        print(
            f"Successfully set '{section}.{option}' to '{value}' for user '{user.username}'."
        )
    else:
        raise ValueError("Invalid configuration option.")