Patched code sample

import os
from flask import Flask, request, jsonify, abort
from functools import wraps

# In a real application, the secret key would be loaded securely
ADMIN_API_KEY = os.environ.get("ARELLE_ADMIN_API_KEY", "a-very-secret-and-strong-key")

app = Flask(__name__)

def load_plugin_from_url(plugin_url: str):
    """
    Simulates the dangerous action of loading a plugin from a remote URL.
    In the fixed version, this function is only callable after an
    authentication and authorization check has passed.
    """
    print(f"[INFO] Securely processing plugin installation for: {plugin_url}")
    # In a real, secure implementation, this would not execute code directly.
    # It might validate the URL against an allowlist, check signatures,
    # or install the plugin into a sandboxed environment.
    return {"status": "processed", "plugin": plugin_url}

def require_admin_auth(f):
    """A decorator to protect endpoints that require admin authentication."""
    @wraps(f)
    def decorated_function(*args, **kwargs):
        auth_header = request.headers.get("Authorization")
        if not auth_header or auth_header != f"Bearer {ADMIN_API_KEY}":
            # If authentication fails, reject the request immediately.
            abort(403)  # 403 Forbidden is appropriate for auth failure
        return f(*args, **kwargs)
    return decorated_function

@app.route("/rest/configure")
@require_admin_auth  # <-- THE FIX: This decorator enforces authentication.
def configure_plugins():
    """
    This endpoint allows an authenticated administrator to configure plugins.
    The @require_admin_auth decorator ensures that no unauthenticated requests
    can reach the function's logic that processes the 'plugins' parameter.
    """
    plugin_url = request.args.get("plugins")

    if not plugin_url:
        return jsonify({"error": "The 'plugins' query parameter is required."}), 400

    # This dangerous logic is now only reachable by an authenticated user.
    result = load_plugin_from_url(plugin_url)
    return jsonify(result)

# Example of a vulnerable endpoint for contrast (NOT PART OF THE FIX)
#
# @app.route("/rest/configure_vulnerable")
# def configure_plugins_vulnerable():
#     # VULNERABILITY: No authentication check is performed.
#     plugin_url = request.args.get("plugins")
#     if plugin_url:
#         # An attacker can provide a URL to malicious code, which is executed.
#         load_plugin_from_url(plugin_url)
#     return jsonify({"status": "vulnerable endpoint processed"})