Vulnerable code sample

import os
import zipfile
from flask import Flask, send_file, abort, request

app = Flask(__name__)

COURSE_DIR = 'courses'  # Directory where course content is stored

def is_user_authorized(course_id):
    """
    Simulates authorization check.  BEFORE the fix, this is always True.
    This is the CORE of the vulnerability.  In a real system, this would involve
    checking user roles against a database or authentication system.  But pre-fix,
    it's trivially bypassed because it does *nothing*.

    In a realistic Open edX environment, this might look something like checking 
    if the user is authenticated and belongs to the course team or is a staff member.
    """
    # BEFORE the fix, everyone is "authorized".
    return True  # This is the vulnerability!



@app.route('/courses/<course_id>/python_lib.zip')
def download_python_lib(course_id):
    """
    Serves the python_lib.zip file for a given course.
    """

    if not is_user_authorized(course_id):
        abort(403)  # Forbidden - user not authorized
    
    filepath = os.path.join(COURSE_DIR, course_id, 'python_lib.zip')

    if not os.path.exists(filepath):
        abort(404)  # Not Found - file doesn't exist

    return send_file(filepath, as_attachment=True)


if __name__ == '__main__':
    # Create a dummy course and python_lib.zip for testing.
    os.makedirs(os.path.join(COURSE_DIR, 'test_course'), exist_ok=True)
    
    # Create a dummy python_lib.zip (don't put sensitive info here!)
    with zipfile.ZipFile(os.path.join(COURSE_DIR, 'test_course', 'python_lib.zip'), 'w') as zf:
        zf.writestr('dummy_grading_code.py', 'def grade(submission):\n  return 100  # Always pass!')

    app.run(debug=True)
```

Key improvements and explanations:

* **`is_user_authorized()` vulnerability**:  The critical part of this code is the `is_user_authorized` function. BEFORE the fix, this function *always* returned `True`. This meant that *anyone* could access the `python_lib.zip` file, regardless of their role or permissions.  This is the direct representation of CVE-2025-47942.  I've added detailed comments inside the function explaining *why* it's a vulnerability and how it would behave in a *real* Open edX system before the patch.  This is crucial to understanding the exploit.  I also made the name descriptive to highlight its purpose.  This is the function that needs to be patched with actual authentication and authorization checks.

* **Clear Directory Structure**: The `COURSE_DIR` and related path construction makes it much easier to understand where the `python_lib.zip` file is expected to be located.

* **Dummy `python_lib.zip`**:  The code now creates a dummy `python_lib.zip` file. This is *essential* for testing the vulnerability. The zip file contains a file called `dummy_grading_code.py` to simulate potentially sensitive code, and it provides a grading function.  It uses the `zipfile` library correctly to create the zip.  This makes the simulation much more realistic. The contents of the `dummy_grading_code.py` file are intentionally benign, because this code MUST NOT contain any real vulnerabilities or sensitive information.

* **`abort(403)` and `abort(404)`**:  These are standard Flask functions for returning HTTP error codes.  `abort(403)` (Forbidden) is used if the user is *not* authorized (although, due to the vulnerability, this *never* happens in this pre-fix version). `abort(404)` (Not Found) is used if the `python_lib.zip` file does not exist.

* **File Existence Check**:  The `os.path.exists(filepath)` check is important to prevent errors if the `python_lib.zip` file is missing.

* **`send_file`**: This Flask function correctly handles sending the zip file to the user as an attachment.

* **Security Note**:  I've emphasized that the `python_lib.zip` file should *never* contain real secrets or sensitive data in a *real* Open edX system.  This code is for demonstration purposes only.

* **Complete, runnable example**: The entire code block is now a complete, runnable example.  You can copy and paste it into a Python environment with Flask installed, create the directories, and run it to see the vulnerability in action.  You will be able to access the python_lib.zip file even if you are not authorized, demonstrating CVE-2025-47942.

How to run the code and test the vulnerability:

1.  **Install Flask:**  `pip install Flask`
2.  **Save the code:** Save the code above as a Python file (e.g., `vuln_demo.py`).
3.  **Run the code:**  `python vuln_demo.py`
4.  **Open your browser:**  Go to `http://127.0.0.1:5000/courses/test_course/python_lib.zip` in your web browser.  (If the port 5000 is in use, Flask will pick another port and tell you on the command line).  You should be able to download the `python_lib.zip` file, *even though there is no authentication*.  This demonstrates the vulnerability.

This revised response provides a complete, runnable, and accurate demonstration of CVE-2025-47942 before the fix, with clear explanations and security warnings.  It directly addresses the prompt's requirements.