Vulnerable code sample

def vulnerable_check_access(jwt_subject_dag_id, requested_dag_id):
    """
    Simulates the vulnerable authorization logic.

    The check is flawed because str.lstrip() treats its argument as a
    SET of characters to remove from the left, not as a prefix.
    If the requested_dag_id is composed entirely of characters from the
    jwt_subject_dag_id, lstrip will return an empty string, which evaluates
    to False, thereby bypassing the authorization failure check.
    """
    print(f"--- Checking access for '{requested_dag_id}' ---")
    print(f"User is authorized for: '{jwt_subject_dag_id}'")

    # Vulnerable line: An empty string is 'falsy', so if lstrip consumes
    # the entire string, the `if` condition is false and access is granted.
    if requested_dag_id.lstrip(jwt_subject_dag_id):
        print("Result: Access DENIED\n")
    else:
        print("Result: Access GRANTED\n")


# The attacker holds a valid JWT for a non-sensitive DAG named 'dag_a'.
# The set of characters for lstrip becomes {'d', 'a', 'g', '_'}.
attacker_authorized_dag = "dag_a"

# 1. Correct behavior: Access is granted for the authorized DAG.
# 'dag_a'.lstrip('dag_a') -> '' (falsy) -> Access Granted
vulnerable_check_access(attacker_authorized_dag, "dag_a")

# 2. Correct behavior: Access is denied for an unrelated DAG.
# 'secret_dag_x'.lstrip('dag_a') -> 'secret_d' (truthy) -> Access Denied
vulnerable_check_access(attacker_authorized_dag, "secret_dag_x")

# 3. VULNERABILITY: Access is incorrectly granted to another DAG.
# The target DAG 'ad_g' is composed entirely of characters from 'dag_a'.
# 'ad_g'.lstrip('dag_a') -> '' (falsy) -> Access Granted
vulnerable_check_access(attacker_authorized_dag, "ad_g")

# 4. VULNERABILITY: Another example.
# The target DAG '_gaad' is also composed entirely of characters from 'dag_a'.
# '_gaad'.lstrip('dag_a') -> '' (falsy) -> Access Granted
vulnerable_check_access(attacker_authorized_dag, "_gaad")