Patched code sample

import json

def generate_safe_server_code(host: str, agents_file: str) -> str:
    """
    Generates Python source code for an API server, safely encoding
    configuration values to prevent code injection.

    This function represents the fix by using a standard and safe method
    to serialize data into a string format that can be embedded in source code.
    """
    # The vulnerability occurs when configuration values are directly
    # embedded into a code string without proper sanitization.
    # For example, a vulnerable implementation might use:
    # f'api_host = "{host}"'
    # An attacker could provide a host value like:
    # '"); import os; os.system("touch /tmp/pwned") #'
    # which would result in executable injected code.

    # THE FIX:
    # Use a robust serialization function like json.dumps() or repr()
    # to convert the input value into a safe Python string literal.
    # json.dumps() will correctly quote and escape the string, ensuring
    # it is treated only as data, not as code.

    safely_encoded_host = json.dumps(host)
    safely_encoded_agents_file = json.dumps(agents_file)

    code_template = f"""
# --- Start of Generated Server Code ---
import uvicorn
# Assume 'app' is an importable ASGI application, e.g., from my_app import app

# The configuration values below are safely encoded as Python string literals.
# They cannot break out of the string to execute arbitrary code.
api_host = {safely_encoded_host}
agents_file = {safely_encoded_agents_file}

def start_server():
    print(f"Starting server on host: {{api_host}}")
    print(f"Using agents file: {{agents_file}}")

    # The uvicorn.run() call receives a guaranteed-safe string value.
    # uvicorn.run(app, host=api_host, port=8000)

if __name__ == "__main__":
    start_server()
# --- End of Generated Server Code ---
"""
    return code_template