patched-codes · patched-codes · Jun 26, 2025 · Jun 26, 2025
diff --git a/html.js b/html.js
@@ -2,6 +2,7 @@
 import PropTypes from 'prop-types'
 import React, { PureComponent } from 'react'
 import serialize from 'serialize-javascript'
+import DOMPurify from 'dompurify'
 
 // @twreporter
 import webfonts from '@twreporter/react-components/lib/text/utils/webfonts'
@@ -26,6 +27,36 @@ export default class Html extends PureComponent {
     styleElement: PropTypes.arrayOf(PropTypes.element).isRequired,
     helmet: PropTypes.object.isRequired,
   }
+
+  // Add script loading function that will be called from script tag
+  static loadTypekit() {
+    const config = {
+      kitId: 'vlk1qbe',
+      scriptTimeout: 3000,
+      async: true
+    };
+    const d = document;
+    const h = d.documentElement;
+    const t = setTimeout(() => {
+      h.className = h.className.replace(/\bwf-loading\b/g, "") + " wf-inactive";
+    }, config.scriptTimeout);
+    const tk = d.createElement("script");
+    let f = false;
+    const s = d.getElementsByTagName("script")[0];
+    h.className += " wf-loading";
+    tk.src = 'https://use.typekit.net/' + config.kitId + '.js';
+    tk.async = true;
+    tk.onload = tk.onreadystatechange = function() {
+      const a = this.readyState;
+      if (f || (a && a !== "complete" && a !== "loaded")) return;
+      f = true;
+      clearTimeout(t);
+      try {
+        Typekit.load(config);
+      } catch (e) {}
+    };
+    s.parentNode.insertBefore(tk, s);
+  }
   render() {
     const {
       contentMarkup,
@@ -110,34 +141,21 @@ export default class Html extends PureComponent {
           {styleElement}
         </head>
         <body>
-          <div id="root" dangerouslySetInnerHTML={{ __html: contentMarkup }} />
+          <div id="root" dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(contentMarkup) }} />
           <script
             defer
             src="https://cdn.polyfill.io/v2/polyfill.min.js?features=Intl.~locale.zh-Hant-TW"
           />
-          <script
-            dangerouslySetInnerHTML={{
-              __html: `window.__REDUX_STATE__=${serialize(store.getState())};`,
-            }}
-            charSet="UTF-8"
-          />
+          <script 
+            id="initial-state" 
+            type="application/json"
+          >{serialize(store.getState(), { isJSON: true })}</script>
+          <script src="/static/init-state.js"></script>
           {_.map(scripts, (script, key) => (
             <script src={script} key={'scripts' + key} charSet="UTF-8" />
           ))}
           {scriptElement}
-          <script
-            dangerouslySetInnerHTML={{
-              __html: `(function(d) {
-                var config = {
-                  kitId: 'vlk1qbe',
-                  scriptTimeout: 3000,
-                  async: true
-                },
-                h=d.documentElement,t=setTimeout(function(){h.className=h.className.replace(/\bwf-loading\b/g,"")+" wf-inactive";},config.scriptTimeout),tk=d.createElement("script"),f=false,s=d.getElementsByTagName("script")[0],a;h.className+=" wf-loading";tk.src='https://use.typekit.net/'+config.kitId+'.js';tk.async=true;tk.onload=tk.onreadystatechange=function(){a=this.readyState;if(f||a&&a!="complete"&&a!="loaded")return;f=true;clearTimeout(t);try{Typekit.load(config)}catch(e){}};s.parentNode.insertBefore(tk,s)
-              })(document);
-            `,
-            }}
-          />
+          <script defer>{`(${Html.loadTypekit.toString()})();`}</script>
         </body>
       </html>
     )

diff --git a/main.py b/main.py
@@ -1,13 +1,37 @@
 import requests
 import subprocess
+import re
+import logging
 
 def func_calls():
     formats.get_format()
     algorithms.HMACAlgorithm.prepare_key()
     cli.VerifyOperation.perform_operation()
     sessions.SessionRedirectMixin.resolve_redirects()
 
+def validate_hostname(hostname):
+    """Validate hostname using regex pattern."""
+    pattern = r'^[a-zA-Z0-9.-]+$'
+    return bool(re.match(pattern, hostname))
+
+def safe_ping(hostname):
+    """Execute ping command safely with input validation."""
+    if not validate_hostname(hostname):
+        logging.warning(f"Invalid hostname attempted: {hostname}")
+        raise ValueError("Invalid hostname. Only alphanumeric characters, dots, and hyphens are allowed.")
+
+    try:
+        logging.info(f"Executing ping command for hostname: {hostname}")
+        result = subprocess.call(['ping', hostname], shell=False)
+        return result
+    except Exception as e:
+        logging.error(f"Error executing ping command: {str(e)}")
+        raise
+
 if __name__ == '__main__':
+    # Set up logging
+    logging.basicConfig(level=logging.INFO)
+
     session = requests.Session()
     proxies = {
         'http': 'http://test:pass@localhost:8080',
@@ -18,9 +42,12 @@ def func_calls():
     prep = req.prepare()
     session.rebuild_proxies(prep, proxies)
 
-    # Introduce a command injection vulnerability
-    user_input = input("Enter a command to execute: ")
-    command = "ping " + user_input
-    subprocess.call(command, shell=True)
-
-    print("Command executed!")
+    # Execute ping command safely
+    try:
+        user_input = input("Enter a hostname to ping: ")
+        safe_ping(user_input)
+        print("Command executed successfully!")
+    except ValueError as e:
+        print(f"Error: {e}")
+    except Exception as e:
+        print(f"An unexpected error occurred: {e}")