Patched code sample

def _validate_css_for_injection(content: str) -> None:
    """
    Prevents Reflected XSS by ensuring the provided content cannot break
    out of the intended <style> context. This represents the core of the fix
    for CVE-2025-66469.

    It works by disallowing substrings that an attacker would use to close
    the style tag and inject malicious script tags.
    """
    # Use lowercase for case-insensitive matching
    lower_content = content.lower()

    # Block the primary injection vector: a closing style tag
    if '</style>' in lower_content:
        raise ValueError('CSS content is not allowed to contain "</style>".')

    # As a defense-in-depth measure, also block closing script tags
    if '</script>' in lower_content:
        raise ValueError('CSS content is not allowed to contain "</script>".')


def add_css(content: str) -> None:
    """
    Represents the fixed version of ui.add_css.

    The fix is to call the validation function before any further processing.
    """
    _validate_css_for_injection(content)
    # ... original logic to add the validated CSS to the page would proceed here ...


def add_scss(content: str) -> None:
    """
    Represents the fixed version of ui.add_scss.

    The fix is to call the validation function before compilation and processing.
    """
    _validate_css_for_injection(content)
    # ... original logic to compile the validated SCSS and add it to the page would proceed here ...


def add_sass(content: str) -> None:
    """
    Represents the fixed version of ui.add_sass.

    The fix is to call the validation function before compilation and processing.
    """
    _validate_css_for_injection(content)
    # ... original logic to compile the validated SASS and add it to the page would proceed here ...