Patched code sample

import json

def safe_process_data(data: bytes):
    """
    Represents the fixed code for a deserialization vulnerability like CVE-2025-14931.

    This function safely deserializes user-supplied data by using the JSON
    format, which is designed for data interchange and cannot execute arbitrary code.
    It replaces a hypothetical insecure implementation that would have used `pickle.load()`
    or `pickle.loads()` on untrusted data.

    Args:
        data: A byte string containing serialized data from an untrusted source.

    Returns:
        The deserialized Python object (e.g., a dict or list) if the data is
        valid JSON, otherwise None.
    """
    try:
        # The core of the fix is to switch from a dangerous deserializer like
        # pickle to a safe, data-only format like JSON.

        # 1. Decode the byte string into a standard string format (e.g., UTF-8).
        #    This is a necessary step before parsing with the json module.
        data_str = data.decode('utf-8')

        # 2. Use json.loads() to parse the data. This function only builds
        #    Python objects like dicts, lists, strings, and numbers. It will
        #    not execute any functions or code embedded in the data stream,
        #    which is what makes pickle dangerous with untrusted input.
        deserialized_object = json.loads(data_str)

        # 3. (Optional but recommended) Further validation can be performed here
        #    on the structure and content of `deserialized_object` to ensure it
        #    conforms to the application's expectations before it is used.

        return deserialized_object

    except (json.JSONDecodeError, UnicodeDecodeError):
        # If the data is not valid JSON or cannot be decoded (e.g., it's a
        # malicious pickle stream), it is safely rejected by catching the
        # exception. This provides the "proper validation of user-supplied data"
        # that was missing in the vulnerable version.
        return None
    except Exception:
        # Catch any other unexpected errors during processing for robustness.
        return None