Vulnerable code sample

import os
from flask import Flask, request, jsonify

# This is a simplified representation of the vulnerable pyLoad application.
# The actual pyLoad codebase is more complex, but this captures the essence
# of the path traversal vulnerability in the file upload functionality.

app = Flask(__name__)
UPLOAD_FOLDER = 'uploads'
app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER

# Ensure the upload directory exists
if not os.path.exists(UPLOAD_FOLDER):
    os.makedirs(UPLOAD_FOLDER)

@app.route('/json/upload', methods=['POST'])
def upload_file():
    """Vulnerable function that demonstrates the security issue."""
    # In a real application, there would be an authentication check here.
    # We assume the user is authenticated for this demonstration.

    if 'file' not in request.files:
        return jsonify({"error": "No file part"}), 400

    file = request.files['file']

    if file.filename == '':
        return jsonify({"error": "No selected file"}), 400

    if file:
        # VULNERABLE PART: The filename from the request is used directly
        # without any sanitization or validation. An attacker can provide
        # a filename like "../../../../../tmp/pwned.txt" to write a file
        # outside of the intended UPLOAD_FOLDER.
        filename = file.filename

        # The os.path.join call will naively combine the base directory
        # with the malicious path provided by the attacker, allowing traversal.
        save_path = os.path.join(app.config['UPLOAD_FOLDER'], filename)
        
        # To prevent accidental damage on the system running this PoC,
        # we normalize the path and check if it's still within the intended
        # upload directory. The VULNERABLE code did NOT have this check.
        # For this demonstration to be safe, we'll print the intended action
        # instead of performing the actual file write.
        # The line that was actually executed in the vulnerable version was:
        # file.save(save_path)
        
        print(f"[VULNERABLE ACTION] Intending to save file to: {save_path}")
        
        # To make this script runnable without causing harm, the actual save is commented out.
        # In the real vulnerable version, this line would be active:
        # file.save(save_path)

        # Simulating a successful response
        return jsonify({"message": f"File '{filename}' upload processed.", "save_path": save_path}), 200

if __name__ == '__main__':
    # To test this vulnerability:
    # 1. Run this Python script.
    # 2. Use a command like curl to simulate the malicious upload:
    #    curl -X POST -F "file=@/path/to/some/local/file.txt;filename=../../../../tmp/pwned_by_poc.txt" http://127.0.0.1:5000/json/upload
    # 3. Check the console output of the script. It will show that it intended
    #    to write to a path outside the 'uploads' directory. In a real vulnerable
    #    instance, the file would have been created at /tmp/pwned_by_poc.txt.
    app.run(debug=True, port=5000)