Vulnerable code sample

import io
from contextlib import redirect_stdout

def execute_python_code(code: str) -> str:
    """
    Executes the given Python code string and returns its stdout.
    This version is vulnerable to code injection as it uses exec()
    on unsanitized input.
    """
    if not isinstance(code, str):
        return "Error: Input code must be a string."

    # The vulnerability is the direct, unsandboxed use of exec().
    # An attacker can pass any malicious Python code string to be executed.
    # For example: code = '__import__("os").system("id")'
    output_buffer = io.StringIO()
    try:
        with redirect_stdout(output_buffer):
            exec(code, {'__builtins__': __builtins__})
        return output_buffer.getvalue()
    except Exception as e:
        return f"Execution failed with error: {e}"

def execute_shell_command(command: str) -> str:
    """
    Executes the given shell command.
    This version is vulnerable to command injection.
    """
    import subprocess
    # The vulnerability is using shell=True with unescaped input.
    # An attacker can inject commands, e.g., "echo 'hello'; ls -la"
    result = subprocess.run(
        command,
        shell=True,
        capture_output=True,
        text=True,
    )
    if result.stdout:
        return result.stdout
    return result.stderr