Patched code sample

import json
from django.http import JsonResponse
from django.contrib.auth.decorators import permission_required
from .models import Project  # Assuming a 'Project' model exists

# This is a representation of the fixed view function.
# The original vulnerable function used eval() on the 'ids' parameter.
# The fix replaces the unsafe eval() with json.loads() for safely parsing the input.

@permission_required('project.change_project', raise_exception=True)
def project_bulk_archive(request):
    """
    Archives multiple projects based on a list of IDs provided in the 'ids'
    query parameter.
    """
    # Get the string containing a list of IDs from the query parameters.
    # e.g., 'ids=[1, 2, 3]'
    project_ids_str = request.GET.get('ids')

    if not project_ids_str:
        return JsonResponse({'status': 'error', 'message': 'No project IDs provided.'}, status=400)

    try:
        # THE FIX: Safely parse the input string using json.loads().
        # This replaces the dangerous `eval(project_ids_str)` which allowed
        # arbitrary code execution. json.loads() will only parse valid JSON
        # and does not execute code, mitigating the RCE vulnerability.
        project_ids = json.loads(project_ids_str)

        # Further validation to ensure the parsed data is a list of integers.
        if not isinstance(project_ids, list) or not all(isinstance(item, int) for item in project_ids):
            raise ValueError("Input must be a JSON array of integers.")

        # Perform the bulk update operation on the validated list of IDs.
        updated_count = Project.objects.filter(id__in=project_ids).update(is_archived=True)

        return JsonResponse({
            'status': 'success',
            'message': f'{updated_count} projects have been archived.'
        })

    except (json.JSONDecodeError, ValueError) as e:
        # Handle cases where the input is not valid JSON or not in the expected format.
        return JsonResponse({'status': 'error', 'message': f'Invalid data format: {e}'}, status=400)
    except Exception as e:
        # Generic error handler for other potential issues.
        return JsonResponse({'status': 'error', 'message': f'An unexpected error occurred: {e}'}, status=500)