Patched code sample

import re
import shlex
from urllib.parse import urlparse

# This code demonstrates the fix for CVE-2026-26331.
# The vulnerability allowed for command injection through the 'netrc_cmd' parameter
# because the hostname ('machine') from a URL was not validated before being
# substituted into a shell command string.
#
# The fix involves strictly validating the hostname to ensure it does not contain
# any characters that could be interpreted by a shell.

def _get_validated_netrc_machine(url):
    """
    Represents the fixed logic in yt-dlp.

    It parses a URL to extract the hostname (the 'machine' for netrc)
    and validates it to prevent command injection. It raises a ValueError if
    the hostname contains any characters not typical for a hostname, such as
    shell metacharacters.

    Args:
        url (str): The URL to process.

    Returns:
        str: The validated hostname.

    Raises:
        ValueError: If the hostname is missing or contains disallowed characters.
    """
    hostname = urlparse(url).hostname
    if not hostname:
        raise ValueError('Could not extract hostname from URL')

    # THE FIX:
    # Validate the hostname to ensure it only contains characters valid for a
    # hostname (alphanumeric, hyphen, dot). This prevents shell metacharacters
    # (like ';', '|', '$', '`', etc.) from being passed to the command.
    if not re.fullmatch(r'[a-zA-Z0-9.-]+', hostname):
        # In a real scenario, this error prevents the malicious string from ever
        # reaching the shell command execution stage.
        raise ValueError(f'Disallowed characters in machine name for netrc-cmd: {hostname!r}')

    return hostname

def simulate_command_execution(url, netrc_cmd_template):
    """
    Simulates the process of building and executing a command with the
    `netrc_cmd` parameter, using the fixed validation logic.
    """
    print(f'--- Processing URL: {url} ---')
    try:
        # 1. Get the hostname using the NEW, FIXED validation logic.
        validated_machine = _get_validated_netrc_machine(url)
        print(f"Hostname '{validated_machine}' passed validation.")

        # 2. Safely construct the command.
        # Note: Even with validation, using shlex.quote is a best practice
        # for defense-in-depth.
        command = netrc_cmd_template.format(shlex.quote(validated_machine))
        print(f"SAFE command to be executed: {command}\n")

    except ValueError as e:
        # The validation logic caught the malicious input and raised an error.
        print(f"VALIDATION FAILED: {e}")
        print("Malicious command execution was PREVENTED.\n")


if __name__ == '__main__':
    # This is the command template a user might provide via `--netrc-cmd`.
    # The `{}` is where the hostname ('machine') is meant to be inserted.
    NETRC_CMD_TEMPLATE = 'my_credential_helper.sh {}'

    # --- Scenario 1: A normal, legitimate URL ---
    # The hostname 'example.com' is valid and passes the check.
    legitimate_url = 'https://user:password@example.com/video.mp4'
    simulate_command_execution(legitimate_url, NETRC_CMD_TEMPLATE)

    # --- Scenario 2: A maliciously crafted URL for command injection ---
    # The "hostname" is '; touch /tmp/pwned; #.example.com'.
    # A vulnerable system would execute:
    #   my_credential_helper.sh ; touch /tmp/pwned; #.example.com
    # The fixed system detects the invalid characters (';', ' ') and stops.
    malicious_url = 'https://user:password@; touch /tmp/pwned; #.example.com/video.mp4'
    simulate_command_execution(malicious_url, NETRC_CMD_TEMPLATE)

    # --- Scenario 3: Another malicious URL using command substitution ---
    # The "hostname" is '`uname -a`.example.com'.
    # The fixed system detects the invalid backtick character and stops.
    malicious_url_2 = 'https://user:password@`uname -a`.example.com/video.mp4'
    simulate_command_execution(malicious_url_2, NETRC_CMD_TEMPLATE)