Patched code sample

import re

def check_origin_fixed(origin: str, allow_origin_pat: str) -> bool:
    """
    Checks if an origin is allowed, representing the fix for CVE-2026-40110.

    The fix involves using re.fullmatch() instead of the vulnerable re.match().
    re.fullmatch() ensures the entire origin string matches the pattern,
    preventing malicious subdomains from being incorrectly validated.
    """
    try:
        # The fix is to use re.fullmatch(), which requires the entire string to match.
        return bool(re.fullmatch(allow_origin_pat, origin))
    except re.error:
        return False

# --- Demonstration of the fix ---

# Configuration pattern intended to allow only 'trusted.example.com'
# Note: A real-world pattern should escape dots, e.g., r'trusted\.example\.com'
allowed_pattern = r"trusted.example.com"

# A legitimate origin that should be allowed.
trusted_origin = "trusted.example.com"

# A malicious origin that would have been allowed by the vulnerable re.match().
# The fixed code will correctly reject this.
malicious_origin = "trusted.example.com.evil.com"

# A completely unrelated origin that should be rejected.
unrelated_origin = "another-site.com"


print(f"Pattern: '{allowed_pattern}'\n")

# --- Verification ---
# The fixed function correctly allows the trusted origin.
is_trusted_allowed = check_origin_fixed(trusted_origin, allowed_pattern)
print(f"Checking '{trusted_origin}': {'Allowed' if is_trusted_allowed else 'Rejected'}")

# The fixed function correctly REJECTS the malicious origin.
is_malicious_allowed = check_origin_fixed(malicious_origin, allowed_pattern)
print(f"Checking '{malicious_origin}': {'Allowed' if is_malicious_allowed else 'Rejected'}")

# The fixed function correctly rejects an unrelated origin.
is_unrelated_allowed = check_origin_fixed(unrelated_origin, allowed_pattern)
print(f"Checking '{unrelated_origin}': {'Allowed' if is_unrelated_allowed else 'Rejected'}")