Patched code sample

import re
import html

# This code demonstrates the fix for the vulnerability (correctly identified as
# CVE-2023-44899). The vulnerability was caused by a regex that only checked
# if a string *started* with a number, not if the *entire string* was a number.

# The fix involves changing the regex to anchor it to the end of the string
# with '$'. This ensures the entire value is validated, preventing the injection
# of arbitrary CSS.
_FIXED_NUM_RE = re.compile(r"^\d+(?:\.\d*)?$")


def render_image_with_fixed_validation(alt: str, src: str, width: str = None) -> str:
    """
    Simulates rendering an image tag using the patched validation logic from
    mistune version 3.2.1. It will only apply the 'width' if it strictly
    matches the numerical pattern, thus preventing CSS injection.
    """
    style_str = ""

    # The 'if' condition below represents the core of the security fix.
    # It uses the corrected regex to validate the entire 'width' string.
    if width and _FIXED_NUM_RE.match(width):
        # The value is now confirmed to be a simple number, so it is safe.
        # The actual patch also correctly appends 'px' to form valid CSS.
        style_str = f'style="width: {width}px;"'

    safe_alt = html.escape(alt, quote=True)
    safe_src = html.escape(src, quote=True)

    # Construct the final tag, only including the style attribute if it was generated.
    return f'<img src="{safe_src}" alt="{safe_alt}"{f" {style_str}" if style_str else ""}>'


if __name__ == '__main__':
    # --- DEMONSTRATION ---

    # 1. A valid, non-malicious width value.
    valid_width = "150"
    print("--- Using a valid width ---")
    print(f"Input width: '{valid_width}'")
    print("Resulting HTML (Correct):")
    print(render_image_with_fixed_validation(
        "A test image", "image.jpg", valid_width
    ))
    print("-" * 40)

    # 2. A malicious string that the vulnerable regex would have accepted.
    #    The old regex would match "100" and let the rest of the string pass.
    malicious_width = "100; background: red; /*"
    print("--- Using a malicious width ---")
    print(f"Input width: '{malicious_width}'")
    print("Resulting HTML (Securely Handled):")
    # The fixed code rejects this input, and no style attribute is added.
    print(render_image_with_fixed_validation(
        "An evil image", "evil.jpg", malicious_width
    ))