Patched code sample

import cgi
import base64
import hmac
import hashlib

# In a real application, this key would be loaded from a secure configuration
# store or an environment variable, not hardcoded.
SERVER_SECRET_KEY = b'f8a2-a9d9-4a2c-a8e5-3d3e8a9d9b9c-a8e5-3d3e-VERY-SECRET'

def is_valid_token(user_identifier, token):
    """
    Securely validates a token against a user identifier.

    This function generates the expected HMAC signature for the user_identifier
    and compares it to the provided token in a timing-attack-resistant manner.

    Args:
        user_identifier (str): The data that was signed (e.g., username).
        token (str): The base64-encoded HMAC signature to validate.

    Returns:
        bool: True if the token is valid, False otherwise.
    """
    if not user_identifier or not token:
        return False
    try:
        # Re-generate the expected signature for the given identifier.
        expected_mac = hmac.new(
            SERVER_SECRET_KEY,
            msg=user_identifier.encode('utf-8'),
            digestmod=hashlib.sha256
        ).digest()
        expected_token = base64.urlsafe_b64encode(expected_mac).decode('utf-8')

        # Use hmac.compare_digest to prevent timing attacks.
        return hmac.compare_digest(expected_token, token)
    except (ValueError, TypeError):
        # Handle malformed tokens or other errors gracefully.
        return False

# --- Main script logic (simulating a CGI script like vLogin.py) ---

# This simulates fetching parameters from a web request.
form = cgi.FieldStorage()

# The 'title' parameter is interpreted as the user identifier being authenticated.
# The 'chkid' parameter is the security token to be validated.
# The 'oIP' parameter is for logging/context.
title = form.getvalue('title')
chkid = form.getvalue('chkid')
oIP = form.getvalue('oIP')

# --- DEMONSTRATION OF THE FIX ---

# VULNERABLE CODE (REMOVED AND REPLACED):
# The original, vulnerable code executed the 'chkid' parameter after base64 decoding it.
# This allowed for remote code execution.
#
# if chkid:
#     try:
#         # DANGEROUS: Decodes and executes untrusted user input.
#         decoded_payload = base64.b64decode(chkid).decode('utf-8')
#         exec(decoded_payload) # CVE-2025-54322 VULNERABILITY
#     except Exception as e:
#         print(f"Content-type: text/html\n\nError: {e}")

# FIXED CODE:
# The 'chkid' parameter is now treated as data and validated using a secure
# cryptographic function. The 'exec()' call has been completely removed.
if is_valid_token(user_identifier=title, token=chkid):
    # If the token is valid, proceed with the application logic.
    print("Content-type: text/html\n")
    print("<h1>Login Successful</h1>")
    print(f"<p>Access granted for user '{title}' from IP '{oIP}'.</p>")
    # (Application logic for a successful login would follow here)
else:
    # If the token is invalid, missing, or malformed, deny access.
    print("Content-type: text/html\n")
    print("<h1>Access Denied</h1>")
    print("<p>Invalid or expired session token.</p>")