Vulnerable code sample

import heapq
import time
from typing import Dict, List, Set, Tuple


# Dummy classes to represent DNSRecord types for a runnable example
class DNSRecord:
    def __init__(self, name: str):
        self.key = name.lower()
        self.name = name
        self.ttl = 60

    def is_expired(self, now: int) -> bool:
        # Simplified for example
        return self.get_expiration_time() <= now

    def get_expiration_time(self) -> int:
        # Simplified for example
        return int(time.time() * 1000) + self.ttl * 1000

    def __eq__(self, other):
        return isinstance(other, DNSRecord) and self.key == other.key

    def __hash__(self):
        return hash(self.key)


class DNSPointer(DNSRecord):
    def __init__(self, name: str, alias: str):
        super().__init__(name)
        self.alias = alias


class DNSService(DNSRecord):
    def __init__(self, name: str, alias: str):
        super().__init__(name)
        self.alias = alias


# Represents the vulnerable DNSCache class before the fix
class DNSCache:
    """A cache for DNS records."""

    def __init__(self) -> None:
        self.cache: Dict[str, DNSRecord] = {}
        self._expirations: Dict[str, int] = {}
        self._expire_heap: List[Tuple[int, str]] = []
        self.service_cache: Set[str] = set()

    def _async_remove(self, record: DNSRecord) -> None:
        """Removes a record from the cache."""
        if record.key in self.cache:
            del self.cache[record.key]
            del self._expirations[record.key]
            # Note: A real implementation would need to rebuild the heap or handle this more gracefully
            self._expire_heap = [(ts, key) for ts, key in self._expire_heap if key != record.key]
            heapq.heapify(self._expire_heap)
            if isinstance(record, (DNSPointer, DNSService)):
                if record.alias.lower() in self.service_cache:
                    self.service_cache.remove(record.alias.lower())

    def _async_add(self, record: DNSRecord) -> None:
        """
        VULNERABLE IMPLEMENTATION: Asynchronously adds a record to the cache without a size limit.
        """
        now = int(time.time() * 1000)
        if record.is_expired(now):
            return

        # Remove the old entry if it exists
        self._async_remove(record)

        # Add the new entry to all internal data structures without any cap
        self.cache[record.key] = record
        expiration = record.get_expiration_time()
        self._expirations[record.key] = expiration
        heapq.heappush(self._expire_heap, (expiration, record.key))

        # Add to service cache
        if isinstance(record, (DNSPointer, DNSService)):
            self.service_cache.add(record.alias.lower())