CWE-94: Improper Control of Generation of Code ('Code Injection')

$MessageFile = "messages.out";if ($_GET["action"] == "NewMessage") {$name = $_GET["name"];$message = $_GET["message"];$handle = fopen($MessageFile, "a+");fwrite($handle, "<b>$name</b> says '$message'<hr>\n");fclose($handle);echo "Message Saved!<p>\n";}else if ($_GET["action"] == "ViewMessages") {include($MessageFile);}

name=h4x0rmessage=%3C?php%20system(%22/bin/ls%20-l%22);?%3E

<?php system("/bin/ls -l");?>

use CGI qw(:standard);
                     sub config_file_add_key {
                        my ($fname, $key, $arg) = @_;
                           
                           # code to add a field/key to a file goes here
                           
                        
                     }
                     sub config_file_set_key {
                        my ($fname, $key, $arg) = @_;
                           
                           # code to set key to a particular file goes here
                           
                        
                     }
                     sub config_file_delete_key {
                        my ($fname, $key, $arg) = @_;
                           
                           # code to delete key from a particular file goes here
                           
                        
                     }
                     sub handleConfigAction {
                        my ($fname, $action) = @_;my $key = param('key');my $val = param('val');
                           
                           # this is super-efficient code, especially if you have to invoke
                           
                           
                           
                           # any one of dozens of different functions!
                           
                           my $code = "config_file_$action_key(\$fname, \$key, \$val);";eval($code);
                     }
                     $configfile = "/home/cwe/config.txt";print header;if (defined(param('action'))) {handleConfigAction($configfile, param('action'));}else {print "No action specified!\n";}

add_key(",","); system("/bin/ls");

config_file_add_key(",","); system("/bin/ls");

def main():
                  
                    sum = 0
		    try:
		    
                      numbers = eval(input("Enter a comma-separated list of numbers: "))
		    
		    except SyntaxError:
		    
		      print("Error: invalid input")
		      return
		    
                    for num in numbers:
                    
                      sum = sum + num
                    
                    print(f"Sum of {numbers} = {sum}")
                  
                  main()

__import__('subprocess').getoutput('rm -r *')

def main():
                  
                    sum = 0
                    numbers = input("Enter a comma-separated list of numbers: ").split(",")
                    try:
                    
                      for num in numbers:
                      
                        sum = sum + int(num)
                      
                      print(f"Sum of {numbers} = {sum}")
                    
                    except ValueError:
                    
                      print("Error: invalid input")
                    
                  
                  main()

name: Deploy Preview
		jobs:
		
		  deploy:
		  
		    runs-on: ubuntu-latest
		    steps:
		    
		      - name: 'Download artifact'
		      uses: actions/github-script
		      with:
		      
			script: |
			
			  var artifacts = await github.actions.listWorkflowRunArtifacts({
			  
			    owner: context.repo.owner,
			    repo: context.repo.repo,
			    run_id: ${{ github.event.workflow_run.id }},
			  
			  });
			  var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => {
			  
			    return artifact.name == "pr"
			  
			  })[0];
			  var downloadPr = await github.actions.downloadArtifact({
			  
			    owner: context.repo.owner,
			    repo: context.repo.repo,
			    artifact_id: matchPrArtifact.id,
			    archive_format: 'zip',
			  
			  });
			  var fs = require('fs');
			  fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(downloadPr.data));
			
		      
		      - run: |
		      
			unzip pr.zip
			echo "pr_number=$(cat NR)" >> $GITHUB_ENV

\nNODE_OPTIONS="--experimental-modules --experiments-loader=data:text/javascript,console.log('injected code');//"

The code could be modified to validate that the NR
		file only contains a numeric value, or the code could
		retrieve the PR number from a more trusted source.