Patched code sample

import os
import subprocess
import sys
from urllib.parse import urlparse

def fixed_package_installer(package_name: str):
    """
    A conceptual fix for CVE-2026-41391.

    This function securely constructs a package installation command by
    validating and sanitizing the index URL provided via an environment
    variable before passing it as a distinct argument to a subprocess.
    """
    command = [sys.executable, "-m", "pip", "install", package_name]

    # Check for relevant environment variables.
    index_url_env = os.environ.get("PIP_INDEX_URL") or os.environ.get("UV_INDEX_URL")

    if index_url_env:
        # 1. Sanitize: Parse the URL to validate its structure.
        parsed_url = urlparse(index_url_env)

        # 2. Validate: Ensure it uses an allowed scheme and has a network location.
        # This prevents injection of local file paths or other schemes.
        if parsed_url.scheme not in ('http', 'https') or not parsed_url.netloc:
            print(f"Error: Invalid or disallowed index URL: {index_url_env}", file=sys.stderr)
            sys.exit(1)

        # 3. Secure Usage: Append the validated URL as a distinct argument.
        # This is the key fix. It prevents the environment variable from being
        # interpreted by a shell, thus blocking command and argument injection.
        command.extend(["--index-url", parsed_url.geturl()])

    # Execute the command safely without using shell=True.
    # The operating system handles the arguments securely.
    try:
        subprocess.run(command, check=True, capture_output=True, text=True)
    except subprocess.CalledProcessError as e:
        print(f"Failed to install package '{package_name}'.", file=sys.stderr)
        print(f"Stderr: {e.stderr}", file=sys.stderr)
        sys.exit(1)