Patched code sample

import sys
import subprocess
import shlex

# Assume TAUTULLI_PATH is the application's root directory
TAUTULLI_PATH = '.'

def runGit(cmd_args):
    """
    Executes a git command securely by taking command arguments as a list
    and using shell=False to prevent command injection.
    """
    try:
        # The key to the fix is shell=False. This ensures that cmd_args
        # are passed directly to the executable ('git') as individual
        # arguments. The operating system shell is not used to interpret
        # the command, which prevents metacharacters like '$', '`', ';', '|'
        # from being executed.
        p = subprocess.Popen(
            cmd_args,  # The command and arguments are a list of strings
            shell=False,  # This is the critical security change
            stdin=subprocess.PIPE,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            close_fds=sys.platform != 'win32',
            cwd=TAUTULLI_PATH,
            # The following are for consistent output across environments
            text=True,
            encoding='utf-8',
            errors='replace'
        )
        (stdout, stderr) = p.communicate()
        return stdout.strip(), stderr.strip(), p.returncode
    except Exception as e:
        print(f"Error executing command: {e}")
        return None, str(e), 1

def checkout_git_branch(remote, branch):
    """
    A function that checks out a git branch using user-provided inputs
    in a secure manner. This function demonstrates how the fixed runGit
    is used.
    """
    print(f"Attempting to fetch remote '{remote}' and branch '{branch}'...")

    # First git command: git fetch <remote> <branch>
    # The user-controlled 'remote' and 'branch' variables are passed as
    # separate items in a list, not as part of a formatted string.
    # This prevents shell injection. For example, if branch was
    # 'my_branch; rm -rf /', it would be treated as a single, literal,
    # and invalid branch name by git, rather than executing 'rm -rf /'.
    cmd_list_fetch = ['git', 'fetch', remote, branch]
    stdout, stderr, returncode = runGit(cmd_list_fetch)

    if returncode != 0:
        print(f"Failed to fetch branch. Git stderr: {stderr}")
        return False

    print("Fetch successful.")

    # Second git command: git checkout -B <branch> <remote>/<branch>
    # The same principle applies here. All parts of the command are
    # elements in a list.
    cmd_list_checkout = ['git', 'checkout', '-B', branch, f'{remote}/{branch}']
    stdout, stderr, returncode = runGit(cmd_list_checkout)

    if returncode != 0:
        print(f"Failed to checkout branch. Git stderr: {stderr}")
        return False

    print(f"Successfully checked out branch '{branch}'.")
    return True


if __name__ == '__main__':
    # --- Demonstration of the Fix ---

    # Malicious input that would have caused remote code execution in the
    # vulnerable version. Here, the attacker tries to inject the 'touch' command.
    malicious_branch_name = 'main; touch /tmp/pwned'
    safe_remote_name = 'origin'

    print("--- Testing with malicious input on FIXED code ---")
    # In the fixed version, the entire malicious string is passed as a single
    # argument to 'git'. The 'git' command will safely reject it as an
    # invalid branch name, and the 'touch' command will NOT be executed.
    checkout_git_branch(safe_remote_name, malicious_branch_name)

    print("\n--- Testing with valid input on FIXED code ---")
    # This would work as expected if 'origin' and 'main' are valid.
    # For this example, it will likely fail if not run in a git repo,
    # but it demonstrates the intended secure usage.
    checkout_git_branch('origin', 'main')