Patched code sample

import xmltodict

# This dictionary contains a key that is not a valid XML element name.
# It is crafted to inject a new <injected> element into the XML structure.
malicious_dict_input = {
    'root': {
        'legitimate_element': 'some_value',
        'another_element><injected>pwned</injected><another_element': 'injected_value'
    }
}

try:
    # In a fixed version of xmltodict (0.15.1+), the unparse function validates
    # element names before generation. When it encounters an invalid name like the
    # one in `malicious_dict_input`, it raises a ValueError.
    # This behavior prevents the malformed key from being injected into the XML output.
    # The underlying xml.sax.saxutils.XMLGenerator is responsible for this validation.
    xml_output = xmltodict.unparse(malicious_dict_input, pretty=True)

    # This code block should NOT be reached in a fixed version.
    print("VULNERABLE: XML was generated without error.")
    print(xml_output)

except ValueError as e:
    # A fixed version correctly raises an exception, thus mitigating the vulnerability.
    # This demonstrates that the input data was validated and the injection was stopped.
    print(f"FIXED: The library correctly blocked the invalid element name.")
    print(f"Caught expected exception: {e}")