Language: Python
Label: vulnerable
CWE: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Code:
    def test_custom_connector_template_loader_disallowed_modules(
        self,
        planet_express_config,
        planet_express_dataset,
        planet_express_icon,
    ):
        CONFIG.security.allow_custom_connector_functions = True

        with pytest.raises(SyntaxError) as exc:
            CustomConnectorTemplateLoader.save_template(
                MagicMock(),
                ZipFile(
                    create_zip_file(
                        {
                            "config.yml": planet_express_config,
                            "dataset.yml": planet_express_dataset,
                            "functions.py": "import os",
                            "icon.svg": planet_express_icon,
                        }
                    )
                ),
            )
        assert "Import of 'os' module is not allowed." == str(exc.value)