Patched code sample

import re

def generate_safe_deployment_script(project_config: dict) -> str:
    """
    Generates a deployment script, safely handling user-provided callback names.

    This function represents the fix for a vulnerability where a user-provided
    value (callback_name) was unsafely interpolated into a code template.

    The fix involves validating that the 'callback_name' is a valid Python
    identifier before incorporating it into the generated code. This prevents
    arbitrary code from being injected.
    """
    callback_name = project_config.get("callback_name")

    if not callback_name:
        raise ValueError("'callback_name' not found in project configuration.")

    # --- THE FIX ---
    # Validate that the callback_name is a simple, valid Python identifier.
    # This prevents injection of arbitrary code constructs like function calls
    # or import statements.
    if not re.fullmatch(r"[a-zA-Z_][a-zA-Z0-9_]*", callback_name):
        raise ValueError(
            f"Invalid callback name: '{callback_name}'. "
            "Name must be a valid Python identifier to prevent code injection."
        )
    # --- END OF FIX ---

    # The validated 'callback_name' can now be safely used in the template.
    generated_code = f"""
# Dynamically generated deployment script
import os

print("Starting deployment process...")

def {callback_name}():
    # This is a placeholder for the user's actual callback function
    print(f"Executing validated user callback: '{callback_name}'")
    print(f"Running as user: {{os.getenv('USER', 'unknown')}}")

# Execute the callback
{callback_name}()

print("Deployment process finished.")
"""
    return generated_code

if __name__ == '__main__':
    # --- DEMONSTRATION ---

    # 1. Benign project configuration (works as expected)
    benign_config = {
        "app_name": "my_app",
        "callback_name": "run_custom_setup"
    }
    print("--- Testing with benign configuration ---")
    try:
        safe_script = generate_safe_deployment_script(benign_config)
        print("Generated script is safe. Simulating execution:")
        # In a real scenario, this script would be saved and executed.
        # We use exec() here for demonstration purposes only.
        exec(safe_script)
    except ValueError as e:
        print(f"Error: {e}")

    print("\n" + "="*40 + "\n")

    # 2. Malicious project configuration (is blocked by the fix)
    # The old, vulnerable version would have interpolated this directly,
    # leading to os.system('echo pwned') being executed.
    malicious_config = {
        "app_name": "my_app",
        "callback_name": "print('hello')\nimport os\nos.system('echo PWNED BY CVE-2026-13749')"
    }
    print("--- Testing with malicious configuration ---")
    try:
        generate_safe_deployment_script(malicious_config)
    except ValueError as e:
        print("Successfully blocked malicious input.")
        print(f"Caught expected error: {e}")