Patched code sample

import json

def validate_node_and_generated_code(node_template: dict, allow_custom_components: bool):
    """
    Validates all code within a node template, including dynamically generated
    fields, to prevent code injection when custom components are disabled.

    This function represents the fix for CVE-2026-9135.
    """
    if allow_custom_components:
        # If custom code is allowed, no validation is needed.
        return

    # Check the main component source code, which was the only check previously.
    main_code = node_template.get("code", {}).get("value")
    if main_code and main_code.strip():
        raise ValueError("Custom components are disabled, but code was found in the main component body.")

    # --- FIX STARTS HERE ---
    # The vulnerability existed because the validation below was missing.
    # The fix is to iterate through all fields in the template, not just the
    # main 'code' block, and validate any field that can contain code.
    
    # Iterate over all fields in the template, which could be dynamic CodeInput fields.
    for field_name, field_properties in node_template.items():
        if isinstance(field_properties, dict):
            # The vulnerability targeted dynamic fields of type 'CodeInput'
            # used by ToolGuard. We check any field that might contain code.
            is_code_field = field_properties.get("type") in ["CodeInput", "Code"]
            
            if is_code_field:
                field_code = field_properties.get("value")
                # If there's any code in this dynamic field, it's a violation
                # of the 'allow_custom_components=false' policy.
                if field_code and field_code.strip():
                    raise ValueError(
                        f"Disallowed code found in dynamic field '{field_name}'. "
                        "Execution is blocked to prevent potential code injection."
                    )
    # --- FIX ENDS HERE ---

    # If all checks pass, the node is considered safe.
    return True