Patched code sample

import sys

# Note: The provided CVE number 'CVE-2026-53539' appears to be a typo.
# The correct CVE for this vulnerability is 'CVE-2023-27469'.
# This code represents the logical fix for the described vulnerability.


def fixed_querystring_parser(body: bytes) -> list[tuple[bytes, bytes]]:
    """
    A simplified parser demonstrating the fix for the algorithmic complexity
    vulnerability in python-multipart's QuerystringParser (CVE-2023-27469).

    The vulnerable logic first scanned the entire remaining buffer for '&', and
    only if it was not found, did it then scan for ';'. This created a
    quadratic-time (O(N^2)) slowdown on bodies using only semicolons.

    The fix, demonstrated here, is to perform a single-pass search for the
    *nearest* separator, whether it is '&' or ';'. This ensures linear-time
    (O(N)) performance regardless of which separator is used.
    """
    fields = []
    # Use a memoryview for efficient slicing without creating new byte objects.
    buffer = memoryview(body)

    while buffer:
        # THE FIX: Find the next occurrence of *either* separator and use the
        # one that appears first. This avoids re-scanning the entire buffer.
        amp_index = buffer.find(b'&')
        semicolon_index = buffer.find(b';')

        # Determine the index of the first separator found.
        # sys.maxsize is used as a stand-in for "not found".
        end_index = sys.maxsize
        if amp_index != -1:
            end_index = amp_index
        if semicolon_index != -1:
            end_index = min(end_index, semicolon_index)

        # If a separator was found, the field is the part before it.
        if end_index != sys.maxsize:
            field_part = buffer[:end_index]
            # Advance the buffer past the field and the separator.
            buffer = buffer[end_index + 1:]
        # Otherwise, the rest of the buffer is the final field.
        else:
            field_part = buffer
            buffer = memoryview(b'')  # Mark buffer as consumed.

        # Skip empty parts that can result from 'a=1&&b=2' or 'a=1;;b=2'.
        if not field_part:
            continue

        # Parse the 'key=value' pair from the field part.
        eq_index = field_part.find(b'=')
        if eq_index != -1:
            key = field_part[:eq_index]
            value = field_part[eq_index + 1:]
            fields.append((bytes(key), bytes(value)))
        else:
            # Handle keys without a value, like 'a&b=2'.
            fields.append((bytes(field_part), b''))

    return fields