Patched code sample

import shlex
from typing import List

def _generate_cloud_setup_script(system_packages: List[str]) -> str:
    """
    Generates a setup script for cloud deployment, safely including system packages.
    
    This function represents the fixed code. The vulnerability stemmed from
    directly interpolating package names into a shell command. The fix is to
    use shlex.quote() to properly sanitize each package name, preventing
    command injection.
    """
    script_lines = ["#!/bin/sh", "set -ex", "apt-get update"]

    if system_packages:
        # VULNERABLE (hypothetical):
        # unsafe_packages_str = " ".join(system_packages)
        # install_cmd = f"apt-get install -y {unsafe_packages_str}"

        # FIXED:
        # Each package name is individually quoted using shlex.quote(). This
        # ensures that any special shell characters within a package name are
        # treated as literal characters, not as command separators or operators.
        # For example, "pkg; malicious-cmd" becomes "'pkg; malicious-cmd'",
        # which the shell treats as a single, non-executable argument.
        quoted_packages_str = " ".join(shlex.quote(pkg) for pkg in system_packages)
        install_cmd = f"apt-get install -y --no-install-recommends {quoted_packages_str}"
        script_lines.append(install_cmd)

    # In a real application, more script lines would be added here.
    # For example:
    # script_lines.append("pip install -r requirements.txt")

    return "\n".join(script_lines)