Patched code sample

import subprocess
import shlex

def execute_python_code(code):
  """
  Executes Python code using subprocess.  This example shows a potential fix 
  to prevent OS command injection.  It uses shlex.quote to properly escape
  user-provided code before passing it to the shell.

  Args:
    code: The Python code to execute.

  Returns:
    A tuple containing the standard output and standard error of the execution.
  """
  try:
    # Properly escape the code using shlex.quote.  This is crucial!
    escaped_code = shlex.quote(code)

    # Use subprocess.run with shell=False and a list of arguments.
    # This avoids shell injection vulnerabilities.
    result = subprocess.run(['python', '-c', escaped_code], capture_output=True, text=True, timeout=10)
    stdout = result.stdout
    stderr = result.stderr
    return stdout, stderr
  except subprocess.TimeoutExpired:
    return "", "Execution timed out."
  except Exception as e:
    return "", f"Error executing code: {e}"

# Example usage (demonstrates how injection is prevented)
if __name__ == '__main__':
  user_input = "import os; os.system('rm -rf /'); print('Hello')" # Malicious input
  stdout, stderr = execute_python_code(user_input)
  print("Stdout:", stdout)
  print("Stderr:", stderr)