The function below builds a shell command string by concatenating a filename into it — the kind of string a naive subprocess.run(cmd, shell=True) call would execute.
The bug: an attacker can pass "report.txt; rm -rf /" as the filename. When run with shell=True, the shell treats ; as a command separator and executes both commands.
Your task: fix solve(filename) so it returns an argument list — ['cat', filename] — instead of a shell string. Passed to subprocess.run(argv, shell=False), the filename is treated as a single literal argument no matter what characters it contains; there's no shell to interpret ;, $(), or &&.
solve('report.txt') # → ['cat', 'report.txt']
solve('file; rm -rf /') # → ['cat', 'file; rm -rf /'] (one argument, not two commands)Sample tests