Patched code sample

import subprocess
import os

# This represents the static, non-generated script that would be executed.
SERVER_SCRIPT_PATH = "run_server.py"

def fixed_deploy_api(agents_file_parameter: str):
    """
    Fixed function that sanitizes the agents_file parameter and passes it
    safely as a command-line argument, preventing code and path injection.
    """
    # 1. Sanitize the input to prevent path traversal. This ensures the input
    # is treated as a simple filename, not a relative or absolute path.
    # This is a key part of the fix.
    sanitized_filename = os.path.basename(agents_file_parameter)

    # In a real application, this would point to a secure, non-user-writable directory.
    base_directory = "/var/praison/agents"
    full_safe_path = os.path.join(base_directory, sanitized_filename)

    # 2. Prepare the command and its arguments as a list. This is the
    # safest way to call a subprocess, as it prevents shell injection.
    # The user input is passed as an argument (data), not embedded into a
    # code string to be executed (which was the original f-string vulnerability).
    command_args = [
        "python",
        SERVER_SCRIPT_PATH,
        "--agents-file",
        full_safe_path,
    ]

    # The command would now be executed securely using the list of arguments.
    # The subprocess call treats each item in the list as a distinct argument,
    # neutralizing any attempts to inject code or additional shell commands.
    # For example: subprocess.Popen(command_args)

    # Returning the prepared command for inspection.
    return command_args