Vulnerable code sample

import io
import sys
from functools import wraps
from flask import Flask, request, jsonify, abort

# --- Mocks and Simulation Setup ---

app = Flask(__name__)

# The configuration is set to FALSE, but will be ignored by the vulnerable endpoint.
app.config['ENABLE_CODE_EXECUTION'] = False

def is_verified_user(auth_header):
    # In a real app, this would validate a session. For this example, any non-empty
    # Authorization header is considered a "verified user".
    return auth_header is not None

def require_verified_user(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        # Simulate checking if the user is verified (logged in).
        if not is_verified_user(request.headers.get('Authorization')):
            abort(401) # Unauthorized
        return f(*args, **kwargs)
    return decorated_function

# --- The Vulnerable Endpoint ---

@app.route('/api/v1/utils/code/execute', methods=['POST'])
@require_verified_user
def execute_code():
    """
    This endpoint executes Python code from the request body for any
    verified user, ignoring the global 'ENABLE_CODE_EXECUTION' setting.
    """
    try:
        data = request.get_json()
        code = data.get('code')
    except Exception:
        return jsonify({"error": "Invalid JSON"}), 400

    if not code:
        return jsonify({"error": "No code provided"}), 400

    # VULNERABILITY:
    # The code does NOT check app.config['ENABLE_CODE_EXECUTION'] before
    # proceeding. It directly executes code for any verified user.
    # A fixed version would have an `if` check here to enforce the setting.

    old_stdout = sys.stdout
    redirected_output = io.StringIO()
    sys.stdout = redirected_output

    try:
        # Execute the user-provided, arbitrary code.
        exec(code, {})
    except Exception as e:
        # If the user's code has an error, return the error message.
        sys.stdout = old_stdout
        return jsonify({"error": str(e)}), 500
    finally:
        # Always restore stdout to prevent server state corruption.
        sys.stdout = old_stdout

    # Capture the output from the executed code.
    output = redirected_output.getvalue()

    return jsonify({"result": output})