Vulnerable code sample

import os

class VulnerableClient:
    """
    A simplified, conceptual client representing the behavior of
    LangGraph SDK versions 0.3.14 and prior. This is for demonstration only.
    """
    def __init__(self, base_url: str):
        self.base_url = base_url.rstrip('/')

    def _make_request(self, method: str, path: str):
        # In a real SDK, this would use a library like 'requests' or 'httpx'.
        # For this example, we resolve the path and print the final URL
        # to show what the server would receive.
        final_url = os.path.normpath(os.path.join(self.base_url, path))
        print(f"Making {method} request to: {final_url}")

    def delete_thread(self, thread_id: str):
        """
        Constructs a URL to delete a thread. This method is vulnerable
        because it does not sanitize the user-provided 'thread_id'.
        """
        # VULNERABLE CODE: The thread_id is used directly in the path.
        path = f"/threads/{thread_id}"
        self._make_request("DELETE", path)

# --- Demonstration of the vulnerability ---

# Assume the SDK is used to connect to an API at this base URL.
# A reverse proxy might be configured to only allow the user access to
# paths starting with '/threads/'.
client = VulnerableClient("https://api.example.com")

# 1. An attacker provides a crafted identifier.
# Instead of being a simple UUID, it contains path traversal characters.
malicious_thread_id = "ignored_id/../../admin/delete_project/123"

# 2. The developer, unaware, passes the untrusted input directly to the SDK.
# The intended operation is to delete a thread within the user's scope.
print(f"Calling delete_thread with malicious ID: '{malicious_thread_id}'")

# 3. The vulnerable SDK constructs a malicious path.
# The final request targets a different, unauthorized endpoint.
client.delete_thread(malicious_thread_id)