Patched code sample

import subprocess
import shlex
import re
from pathlib import Path
from typing import Optional, List

class SecureCommandProcessor:
    """Secure command processor with validation"""
    
    def __init__(self, allowed_commands: List[str] = None):
        # Whitelist of allowed commands
        self.allowed_commands = allowed_commands or ['echo', 'ls', 'cat', 'grep']
        self.allowed_script_dir = Path('./safe_scripts').resolve()
    
    def process_user_command(self, user_input: str) -> Optional[str]:
        """Securely process user command with validation"""
        try:
            # Input validation
            if not user_input or len(user_input) > 100:
                raise ValueError("Invalid input length")
            
            # Sanitize input - only allow alphanumeric and safe chars
            if not re.match(r'^[a-zA-Z0-9\s._-]+$', user_input):
                raise ValueError("Input contains invalid characters")
            
            # Use subprocess with explicit arguments (no shell)
            result = subprocess.run(
                ['echo', f'Processing: {user_input}'],
                capture_output=True,
                text=True,
                timeout=5
            )
            
            if result.returncode == 0:
                return result.stdout.strip()
            else:
                return None
                
        except Exception as e:
            print(f"Command processing error: {e}")
            return None
    
    def run_safe_script(self, script_name: str) -> bool:
        """Run script from safe directory with validation"""
        try:
            # Input validation
            if not script_name or not isinstance(script_name, str):
                raise ValueError("Invalid script name")
            
            # Sanitize filename
            if not re.match(r'^[a-zA-Z0-9._-]+\.py$', script_name):
                raise ValueError("Invalid script filename")
            
            # Resolve script path
            script_path = (self.allowed_script_dir / script_name).resolve()
            
            # Security checks
            if not script_path.exists() or not script_path.is_file():
                raise FileNotFoundError("Script not found")
            
            # Ensure script is within allowed directory
            if not str(script_path).startswith(str(self.allowed_script_dir)):
                raise ValueError("Script outside allowed directory")
            
            # Run with explicit arguments (no shell)
            result = subprocess.run(
                ['python3', str(script_path)],
                capture_output=True,
                timeout=30,
                cwd=self.allowed_script_dir
            )
            
            return result.returncode == 0
            
        except Exception as e:
            print(f"Script execution error: {e}")
            return False

# Secure usage
processor = SecureCommandProcessor()
result = processor.process_user_command("hello world")
success = processor.run_safe_script("safe_script.py")