Vulnerable code sample

# This script simulates the vulnerable behavior of the Kiota generator before the fix.
# It demonstrates how an unsanitized description from an OpenAPI specification
# can lead to code injection in the generated Python client.

# 1. Attacker-controlled data mimicking part of an OpenAPI specification.
# The 'description' field contains a newline character ('\n') followed by
# malicious Python code.
malicious_spec_part = {
    "name": "InjectedEnum",
    "values": [
        {
            "name": "HARMLESS_MEMBER",
            "description": "This is a normal description."
        },
        {
            "name": "MALICIOUS_MEMBER",
            # The description contains a newline to break out of the comment
            # and inject a new line of executable Python code.
            "description": "Malicious description.\nimport os; os.system('echo CVE-2026-59862 TRIGGERED') # Injected"
        }
    ]
}

def vulnerable_code_generator(spec):
    """
    A simplified simulation of the vulnerable Kiota generator logic.
    It does not sanitize newlines in descriptions, leading to the vulnerability.
    """
    lines = [
        "from enum import Enum",
        "",
        f"class {spec['name']}(Enum):"
    ]

    for value in spec['values']:
        # The vulnerability is here: `description` is not sanitized.
        # A newline character within it will create a new line in the output file.
        description = value['description']
        member_name = value['name']
        
        # The generator intends for the description to be an inline comment.
        line = f'    {member_name} = "{member_name.lower()}"  # {description}'
        lines.append(line)
    
    return "\n".join(lines)

# 2. The generator is run, creating the malicious code string.
# In a real attack, this string would be written to a .py file.
generated_code_string = vulnerable_code_generator(malicious_spec_part)

# 3. The output shows the generated code. When saved to a file and imported,
# the `import os...` line is no longer a comment and will be executed.
print(generated_code_string)