Patched code sample

import tomllib
from typing import Any, Dict


def get_safe_black_version_from_config(pyproject_content: str) -> str:
    """
    Safely parses pyproject.toml content to get the black version specifier.

    This function represents a fix for a vulnerability where a malicious
    user could specify a direct URL dependency in the pyproject.toml file,
    leading to arbitrary code execution.

    The fix involves validating that the version specifier is not a URL
    or path-based dependency.

    Args:
        pyproject_content: A string containing the content of a pyproject.toml file.

    Returns:
        A validated, safe version specifier for black.

    Raises:
        ValueError: If the version specifier is missing, malformed, or
                    determined to be a security risk (e.g., a URL).
    """
    try:
        config: Dict[str, Any] = tomllib.loads(pyproject_content)
    except tomllib.TOMLDecodeError:
        raise ValueError("Failed to parse pyproject.toml content.")

    version_specifier = config.get("tool", {}).get("black", {}).get("version")

    if not isinstance(version_specifier, str) or not version_specifier:
        raise ValueError("Black 'version' not specified or invalid in [tool.black].")

    # --- THE VULNERABILITY FIX ---
    # The vulnerability occurs when the version_specifier is passed directly to a
    # package installer without validation. A malicious value could be
    # "black@git+https://example.com/malicious/repo.git".
    #
    # This fix validates the specifier to ensure it does not contain elements
    # indicative of a direct URL reference, which is the attack vector.
    disallowed_substrings = ["@", "://", "git+", "hg+", "bzr+", "svn+"]
    if any(sub in version_specifier for sub in disallowed_substrings):
        raise ValueError(
            f"Potentially unsafe black version specifier: '{version_specifier}'. "
            "Direct URL dependencies are disallowed."
        )

    # The specifier is considered safe if it passes the validation.
    return version_specifier