Patched code sample

import os
import re

class FixedServer:
    """
    A corrected implementation that replaces dangerous code execution with a safe,
    purpose-built query parser.
    """
    def __init__(self):
        # Simulate some data that the "query" would act upon
        self.data = {
            "users": [{"id": 1, "name": "Alice"}, {"id": 2, "name": "Bob"}],
            "products": [{"id": 101, "name": "Widget"}, {"id": 102, "name": "Gadget"}],
            "config": {"version": "1.1", "enabled": True}
        }
        # Simulate the presence of sensitive environment variables
        os.environ["AWS_ACCESS_KEY_ID"] = "FAKE_KEY_FOR_DEMO"
        os.environ["AWS_SECRET_ACCESS_KEY"] = "FAKE_SECRET_FOR_DEMO"

    def execute_query(self, query_path: str):
        """
        Safely retrieves data from the self.data object based on a dot-separated path.

        This method avoids executing user input. Instead, it parses the query_path
        as a simple data accessor path, preventing any form of code injection.

        Args:
            query_path: A string representing the path to the data,
                        e.g., "users.0.name" or "config.version".

        Returns:
            The requested data or None if the path is invalid or not found.
        """
        # Input validation: only allow alphanumeric characters, dots, and underscores.
        # This is a first line of defense against more complex injection attempts.
        if not re.match(r'^[a-zA-Z0-9_.]+$', query_path):
            # Invalid characters in path, reject immediately.
            return None

        parts = query_path.split('.')
        current_data = self.data

        for part in parts:
            if isinstance(current_data, dict):
                # If current data is a dictionary, treat the part as a key.
                if part in current_data:
                    current_data = current_data[part]
                else:
                    return None  # Key not found
            elif isinstance(current_data, list):
                # If current data is a list, try to treat the part as an index.
                try:
                    index = int(part)
                    if 0 <= index < len(current_data):
                        current_data = current_data[index]
                    else:
                        return None  # Index out of bounds
                except (ValueError, IndexError):
                    return None  # Part is not a valid integer index or index is invalid
            else:
                # Reached a primitive value before the path was fully traversed.
                return None

        return current_data