Vulnerable code sample

import sys
from urllib.parse import urlparse

# This code represents a vulnerable version of the Gakido client (prior to 0.1.1)
# as described in the fictional CVE-2026-24489.
# The vulnerability lies in the lack of sanitization for header names and values,
# allowing for CRLF injection.

class VulnerableGakidoClient:
    """
    A simplified, hypothetical representation of the Gakido HTTP client
    before the fix for CVE-2026-24489 was applied.
    """
    def __init__(self, version="0.1.0"):
        self.version = version

    def _prepare_raw_request(self, method, url, headers=None):
        """
        Prepares the raw HTTP request string. This is where the vulnerability
        is present, as it does not sanitize header values.
        """
        parsed_url = urlparse(url)
        host = parsed_url.netloc
        path = parsed_url.path or "/"

        request_lines = []
        request_lines.append(f"{method.upper()} {path} HTTP/1.1")
        request_lines.append(f"Host: {host}")

        if headers:
            # VULNERABLE PART:
            # The code iterates through user-supplied headers and adds them
            # to the request without stripping special characters like \r, \n, or \x00.
            # An attacker can inject a CRLF sequence (\r\n) followed by new headers.
            for name, value in headers.items():
                request_lines.append(f"{name}: {value}")

        # The final double CRLF signifies the end of the headers.
        raw_request = "\r\n".join(request_lines) + "\r\n\r\n"
        return raw_request.encode('utf-8')

    def get(self, url, headers=None):
        """
        Simulates making a GET request and prints the raw request that would be sent.
        """
        print("--- Raw HTTP Request (as sent by the vulnerable client) ---")
        
        # In a real client, this raw request would be sent over a socket.
        # Here we just print it to demonstrate the injection.
        raw_request = self._prepare_raw_request("GET", url, headers)
        sys.stdout.buffer.write(raw_request)
        sys.stdout.flush()
        print("\n-----------------------------------------------------------")


if __name__ == '__main__':
    # --- Demonstration of the Vulnerability ---

    # 1. Attacker crafts a malicious header value.
    # The value for 'User-Agent' contains a Carriage Return Line Feed (\r\n),
    # which is used to terminate the current header and start a new, injected one.
    malicious_headers = {
        "Accept": "text/html",
        "User-Agent": (
            "Normal-Gakido-Client/0.1.0\r\n"
            "Injected-Header: This header was injected by an attacker!\r\n"
            "Another-Injected-Header: So was this one."
        )
    }

    # 2. The application uses the vulnerable client with the user-controlled headers.
    client = VulnerableGakidoClient()
    target_url = "http://example.com/login"

    print("Demonstrating CVE-2026-24489: HTTP Header Injection")
    print(f"Target URL: {target_url}")
    print("Malicious Headers to be sent:")
    print(malicious_headers)
    print("\n")

    # 3. The client constructs and "sends" the request.
    # The output will show that 'Injected-Header' and 'Another-Injected-Header'
    # have been successfully added to the outgoing HTTP request, even though
    # they were not part of the original headers dictionary's keys.
    client.get(target_url, headers=malicious_headers)