Patched code sample

import os
import shutil
import tempfile
from typing import IO, Optional, Tuple, Union


def _rewrite_file(dotenv_path: Union[str, "os.PathLike[str]"], content: str) -> None:
    """
    Safely rewrites the given file, raising an error if it's a symlink.
    This function contains the core logic that fixes the vulnerability.
    """
    if os.path.islink(dotenv_path):
        raise ValueError("Refusing to write to a file that is a symlink")

    fd, temp_path = tempfile.mkstemp(
        prefix=f".{os.path.basename(dotenv_path)}.", dir=os.path.dirname(dotenv_path)
    )
    try:
        with os.fdopen(fd, "w") as f:
            f.write(content)

        try:
            shutil.copymode(dotenv_path, temp_path)
        except FileNotFoundError:
            pass

        os.rename(temp_path, dotenv_path)
    except Exception:
        os.remove(temp_path)
        raise


def set_key(
    dotenv_path: Union[str, "os.PathLike[str]"],
    key_to_set: str,
    value_to_set: str,
    encoding: Optional[str] = "utf-8",
) -> Tuple[bool, str, str]:
    """
    Demonstrates how the fix is applied. Instead of writing to the file
    directly, it now calls the safe _rewrite_file helper.
    """
    # The actual implementation reads the .env file line by line to build
    # the new content. This part is simplified for clarity.
    if not os.path.exists(dotenv_path):
        new_content = f"{key_to_set}={value_to_set}\n"
    else:
        with open(dotenv_path, encoding=encoding) as f:
            lines = f.readlines()
        # simplified update logic
        new_content = f"{key_to_set}={value_to_set}\n"

    # The vulnerable file write operation is replaced by this safe function call.
    _rewrite_file(dotenv_path, new_content)

    return True, key_to_set, value_to_set