Patched code sample

import docutils.core
from pathlib import Path

# This code demonstrates the fix for the reStructuredText file inclusion vulnerability.
# The core of the fix is to explicitly disable file I/O directives within Docutils settings.

# 1. Create a dummy local file that an attacker might try to access.
secret_file = Path("secret-data.txt")
secret_file.write_text("SENSITIVE_INFORMATION")

# 2. Define malicious reStructuredText input attempting to include the local file.
#    This is the payload that would be sent by an attacker.
malicious_input = f".. include:: {secret_file.name}"

# 3. Define the secure settings for the Docutils publisher.
#    This is the actual fix: 'file_insertion_enabled' and 'raw_enabled' are set to False.
#    Prior to the fix, these settings were not specified, leaving them at their
#    default (and insecure) value of True.
secure_settings_overrides = {
    'report_level': 5,  # Suppress non-error system messages for clean output
    'file_insertion_enabled': False,
    'raw_enabled': False,
}

# 4. Attempt to render the malicious input using the SECURE settings.
#    In a vulnerable application, `secure_settings_overrides` would be an empty dict.
try:
    parts = docutils.core.publish_parts(
        source=malicious_input,
        writer_name='html5',
        settings_overrides=secure_settings_overrides
    )
    html_output = parts['html_body']

    # 5. Print the output and verify the fix.
    print("--- Rendered HTML with Fix ---")
    print(html_output)
    print("----------------------------")

    if "SENSITIVE_INFORMATION" in html_output:
        print("\n[VULNERABILITY] Secret file was read and included.")
    else:
        print("\n[FIX VERIFIED] The 'include' directive was safely disabled.")
        print("The output contains an error/warning instead of the file content.")

finally:
    # 6. Clean up the dummy file.
    if secret_file.exists():
        secret_file.unlink()