Patched code sample

from flask import Flask, request, jsonify

app = Flask(__name__)

# This fixed version of the server endpoints uses JSON, a safe data
# interchange format, for deserializing the request body. This prevents
# arbitrary code execution that is possible with unsafe formats like pickle.

@app.route('/request-inference', methods=['POST'])
def request_inference():
    """
    Safely handles an inference request using JSON.
    This represents a fix for the pickle deserialization vulnerability.
    """
    try:
        # FIX: Use JSON, a safe data interchange format, instead of pickle.
        # Flask's request.get_json() handles the deserialization safely.
        inference_data = request.get_json()

        # Perform input validation on the received data.
        if not inference_data or 'input' not in inference_data:
            return jsonify({"error": "Missing 'input' field in request"}), 400

        # --- Placeholder for actual inference logic ---
        # The validated 'inference_data' can now be safely used.
        result = {"prediction": f"Processed input: {inference_data['input']}"}
        # --- End of placeholder ---

        return jsonify(result), 200

    except Exception as e:
        # Handles malformed JSON or other processing errors.
        return jsonify({"error": f"An error occurred: {str(e)}"}), 500


@app.route('/seed-model', methods=['POST'])
def seed_model():
    """
    Safely seeds a model using JSON for data interchange.
    This represents a fix for deserializing untrusted data.
    """
    try:
        # FIX: Use a safe serialization format like JSON instead of pickle.
        # request.get_json() safely parses the incoming JSON data.
        data = request.get_json()

        # Basic input validation.
        if not data or 'model_name' not in data or 'model_data' not in data:
            return jsonify({"error": "Invalid model data provided"}), 400

        # --- Placeholder for model seeding logic ---
        print(f"Seeding model '{data['model_name']}'...")
        # --- End of placeholder ---

        return jsonify({"status": "Model seeded successfully", "model": data['model_name']}), 200

    except Exception as e:
        # Catch potential parsing errors or other issues.
        return jsonify({"error": f"An error occurred: {str(e)}"}), 500


if __name__ == '__main__':
    # For demonstration purposes only. Use a production WSGI server in a real environment.
    app.run(host='0.0.0.0', port=8080)