Patched code sample

import os
import subprocess
import shlex

def execute_command(command, safe_mode=True):
    """
    Executes a shell command.  Demonstrates a vulnerability if `safe_mode` is False,
    and simulates a fix when `safe_mode` is True.

    Args:
        command (str): The shell command to execute.
        safe_mode (bool): Whether to execute the command in safe mode.  If False,
                           the command is executed directly, demonstrating the vulnerability.
                           If True, the command is sanitized to prevent shell injection.

    Returns:
        tuple: A tuple containing the return code, standard output, and standard error.
    """
    if not isinstance(command, str):
        raise TypeError("Command must be a string.")

    if not isinstance(safe_mode, bool):
        raise TypeError("safe_mode must be a boolean.")
    
    if safe_mode:
        # Simulate a safe execution environment using shlex.split and subprocess.run.
        # This prevents shell injection by properly quoting and escaping arguments.
        try:
            command_list = shlex.split(command)  # Correct usage
            result = subprocess.run(command_list, capture_output=True, text=True, check=False, env=os.environ.copy())
            return result.returncode, result.stdout, result.stderr
        except ValueError as e:
            return 1, "", str(e)
    else:
        # DANGEROUS: Directly executes the command without sanitization.
        # This is vulnerable to shell injection if the command contains user-supplied input.
        try:
            result = subprocess.run(command, shell=True, capture_output=True, text=True, check=False, env=os.environ.copy())  #shell=True is dangerous here
            return result.returncode, result.stdout, result.stderr
        except Exception as e:
            return 1, "", str(e)


def sanitize_command(command):
  """
  A more sophisticated sanitization function to prevent shell injection.
  This example removes potentially dangerous characters and escapes others.
  """
  # Replace potentially dangerous characters with a safe alternative or remove them.
  command = command.replace(";", "")  # Remove command separators
  command = command.replace("&", "")  # Remove background execution
  command = command.replace("|", "")  # Remove pipes
  command = command.replace(">", "")  # Remove redirection
  command = command.replace("<", "")  # Remove redirection
  command = command.replace("`", "")  # Remove backticks

  # Escape characters that have special meaning in the shell.
  command = command.replace("\\", "\\\\")  # Escape backslashes
  command = command.replace("\"", "\\\"")  # Escape double quotes
  command = command.replace("'", "\\'")  # Escape single quotes
  command = command.replace("$", "\\$")  # Escape dollar signs
  command = command.replace("!", "\\!")

  return command

def execute_command_safe(command):
    """
    Executes a command with sanitization.

    Args:
        command (str): The command to execute.

    Returns:
        tuple: A tuple containing the return code, stdout, and stderr.
    """
    sanitized_command = sanitize_command(command)
    try:
        command_list = shlex.split(sanitized_command)  # Correct usage
        result = subprocess.run(command_list, capture_output=True, text=True, check=False, env=os.environ.copy())
        return result.returncode, result.stdout, result.stderr
    except ValueError as e:
        return 1, "", str(e)