Patched code sample

import os
import sys
import importlib.util
from typing import Callable

def _load_model(model_path: str) -> Callable:
    """
    Represents the fixed version of the vulnerable function.

    This function safely loads a 'module.py' file from a user-provided
    directory by using the standard `importlib` library instead of the
    dangerous `exec()` function. This ensures that the file is loaded
    as a proper Python module, preventing arbitrary code execution.
    """
    module_py_path = os.path.join(model_path, "module.py")

    if not os.path.isfile(module_py_path):
        raise FileNotFoundError(
            f"The required 'module.py' was not found in the directory: {model_path}"
        )

    # Create a unique module name based on the path to avoid conflicts.
    module_name = f"custom_model.{os.path.basename(model_path)}"
    
    # Create a module specification from the file path.
    spec = importlib.util.spec_from_file_location(module_name, module_py_path)
    
    if spec is None or spec.loader is None:
        raise ImportError(f"Could not create a module spec for {module_py_path}")

    # Create a new module object from the specification.
    custom_module = importlib.util.module_from_spec(spec)
    
    # Add the module to sys.modules before execution. This is important for
    # allowing relative imports within the loaded module.
    sys.modules[module_name] = custom_module
    
    # Execute the module's code within its own namespace. This is the safe
    # and standard way to load code from a file, replacing exec().
    spec.loader.exec_module(custom_module)

    # Safely get the expected 'create_model' function from the loaded module.
    model_factory = getattr(custom_module, "create_model", None)

    if not callable(model_factory):
        raise AttributeError(
            f"A callable function 'create_model' was not found in {module_py_path}"
        )

    return model_factory