Patched code sample

import sys
from io import StringIO

def execute_safely(user_code: str):
    """
    Executes user-provided Python code in a restricted environment
    to prevent arbitrary command execution. This represents a fix for
    a vulnerability where user input was passed to exec() without validation.
    """
    # A whitelist of safe built-in functions.
    # Crucially, this excludes dangerous functions like 'open', 'eval', 'exec',
    # and '__import__', which could be used for system access.
    SAFE_BUILTINS = {
        'abs', 'all', 'any', 'bin', 'bool', 'dict', 'float', 'int', 'isinstance',
        'len', 'list', 'max', 'min', 'pow', 'range', 'repr', 'round', 'set',
        'sorted', 'str', 'sum', 'tuple', 'type', 'print'
    }

    # Create a dictionary of the allowed built-ins.
    safe_builtins_dict = {
        name: __builtins__[name] for name in SAFE_BUILTINS if hasattr(__builtins__, name)
    }

    # The 'globals' dictionary for the exec() context is carefully constructed.
    # It contains only our whitelisted built-ins and nothing from the
    # surrounding code's scope.
    safe_globals = {"__builtins__": safe_builtins_dict}

    # Redirect stdout to a string buffer to capture any output from the code.
    old_stdout = sys.stdout
    redirected_output = sys.stdout = StringIO()

    try:
        # Execute the user's code. The second argument defines the global scope,
        # and the third defines the local scope. By providing our 'safe_globals'
        # and an empty local scope, we severely limit what the code can do.
        # An attempt to use a disallowed function (e.g., open()) will now
        # raise a NameError because it does not exist in the provided scope.
        exec(user_code, safe_globals, {})

        # Get the captured output.
        output = redirected_output.getvalue()
    except Exception as e:
        # If any error occurs during execution, capture it as a string.
        output = f"Error: {type(e).__name__}: {e}"
    finally:
        # Always restore the original stdout.
        sys.stdout = old_stdout

    return output