Patched code sample

import importlib
import re

def load_tool_module_by_id(tool_id: str):
    """
    Safely loads a tool module by its ID after proper validation.

    This function represents a fix for a command injection vulnerability
    (related to CVE-2024-38356, which matches the description provided).
    The vulnerability is fixed by:

    1.  Strictly validating the 'tool_id' to ensure it only contains
        safe characters (alphanumeric and underscore). This prevents the
        injection of code execution operators (e.g., ';', '()') or
        path traversal sequences ('../').

    2.  Using 'importlib.import_module' instead of a dangerous function like
        'eval()'. The 'importlib' library is the standard, secure way to
        dynamically import Python modules. It treats the input string as a
        module path, not as code to be executed, thereby eliminating the
        remote code execution (RCE) vector.
    """
    # 1. Validate input against an allowlist of safe characters.
    # This regex ensures the ID is a simple, valid Python identifier component.
    if not re.match(r"^[a-zA-Z0-9_]+$", tool_id):
        # If the tool_id contains any forbidden characters, raise an error
        # to prevent any further processing.
        raise ValueError(f"Invalid tool ID format: '{tool_id}'")

    # 2. Construct the full module name within a trusted package namespace.
    # This assumes all valid tools reside within a 'tools' package.
    module_name = f"tools.{tool_id}"

    try:
        # 3. Use the safe importlib.import_module function.
        # This function does not evaluate or execute the content of the string;
        # it only uses it for Python's standard module import mechanism.
        module = importlib.import_module(module_name)
        return module
    except ModuleNotFoundError:
        # Gracefully handle cases where a validly formatted but nonexistent
        # tool is requested. This prevents information leakage.
        # Logging this attempt for security monitoring is recommended.
        print(f"Error: Tool module '{module_name}' not found.")
        return None
    except Exception as e:
        # Catch other potential import-related errors.
        print(f"An unexpected error occurred while loading '{module_name}': {e}")
        return None