Bisheng 中的任意代码执行漏洞
作者: Ro1ME创建于 2026年4月20日更新于 2026年4月20日
src/backend/bisheng/api/v1/validate.py:13-23
@router.post('/code', status_code=200) def post_validate_code(code: Code): try: errors = validate_code(code.code) # User-controlled code passed directly return resp_200( CodeValidationResponse( imports=errors.get('imports', {}), function=errors.get('function', {}), )) except Exception as e: return HTTPException(status_code=500, detail=str(e))
src/backend/bisheng/utils/validate.py:19-53
def validate_code(code): # Initialize the errors dictionary errors = {'imports': {'errors': []}, 'function': {'errors': []}}
# Parse the code string into an abstract syntax tree (AST)
try:
tree = ast.parse(code)
except Exception as e:
errors['function']['errors'].append(str(e))
return errors
# Add a dummy type_ignores field to the AST
add_type_ignores()
tree.type_ignores = []
# Evaluate the import statements
for node in tree.body:
if isinstance(node, ast.Import):
for alias in node.names:
try:
importlib.import_module(alias.name)
except ModuleNotFoundError as e:
errors['imports']['errors'].append(str(e))
# Evaluate the function definition
for node in tree.body:
if isinstance(node, ast.FunctionDef):
code_obj = compile(ast.Module(body=[node], type_ignores=[]), '<string>', 'exec')
try:
exec(code_obj) # VULNERABILITY: Executes user-controlled code
except Exception as e:
errors['function']['errors'].append(str(e))
# Return the errors dictionary
return errors内容来源: dataelement/bisheng