Patched code sample

import os
import sys

def escape_docstring_for_exec(docstring):
    """
    Safely escapes a docstring to be embedded in a triple-quoted string
    by replacing occurrences of '"""' with a non-terminating sequence.
    This represents the fix for the described vulnerability.
    """
    return docstring.replace('"""', '""\\"')

# --- Demonstration of the fix ---

# 1. Define a hostile docstring payload.
# It attempts to close the docstring literal, execute a command, and then
# open and close another string to maintain valid syntax in the vulnerable version.
hostile_docstring = 'legitimate docstring text."""\nimport os\nos.system("echo VULNERABILITY EXPLOITED")\n"""'

# 2. Reconstruct the code that would be passed to exec() for completion analysis.
# The crucial step is applying the escaping function to the docstring.
safe_code_string = f"""
def reconstructed_function():
    \"\"\"{escape_docstring_for_exec(hostile_docstring)}\"\"\"
    pass
"""

# 3. For clarity, print the code string that will be safely executed.
# Notice how the hostile '"""' is now '""\"' inside the code.
print("# The following safe code will be passed to exec():")
print("-" * 50)
print(safe_code_string)
print("-" * 50)


# 4. Execute the code in a separate namespace.
# In the vulnerable version, this would print "VULNERABILITY EXPLOITED".
# With the fix, the hostile code remains part of the docstring and is not executed.
print("# Executing the code...")
exec(safe_code_string, {})
print("# Execution finished. The exploit was not triggered.")