Vulnerable code sample

import os
import argparse
import xml.etree.ElementTree as ET

# This code is a hypothetical representation of the vulnerability described
# in the fictitious CVE-2025-66034. It is not the actual source code from fontTools
# but is designed to functionally demonstrate the described weakness.

def build_variable_font(designspace_path, output_dir="."):
    """
    Simulates the vulnerable part of the varLib build process.
    It parses a .designspace file and unsafely constructs an output path.
    """
    print(f"Processing designspace file: {designspace_path}")

    try:
        tree = ET.parse(designspace_path)
        root = tree.getroot()
    except ET.ParseError as e:
        print(f"Error: Could not parse XML file. {e}")
        return
    except FileNotFoundError:
        print(f"Error: Designspace file not found at '{designspace_path}'")
        return

    # In a real .designspace, output paths might be defined for instances.
    # We will simulate this by looking for a custom <output> tag.
    # A malicious file could define a path that traverses directories.
    # e.g., <output path="../../../../../tmp/malicious_file.txt" />
    output_node = root.find("output")
    if output_node is None:
        print("Warning: No <output> tag found in designspace. Using default name.")
        # Use a default filename if none is provided, to show normal operation
        filename = os.path.basename(designspace_path).replace(".designspace", "-VAR.ttf")
    else:
        filename = output_node.get("path")

    if not filename:
        print("Error: <output> tag found, but 'path' attribute is missing or empty.")
        return

    # --- THE VULNERABILITY ---
    # The 'filename' is taken directly from the designspace file.
    # os.path.join does not sanitize against directory traversal attacks.
    # If `filename` is "../../../etc/passwd", `final_path` will point
    # outside the intended `output_dir`.
    final_path = os.path.join(output_dir, filename)
    final_path = os.path.abspath(final_path)

    print(f"Preparing to write to calculated path: {final_path}")

    try:
        # Ensure the target directory exists. This is also part of the exploit,
        # as it creates the directory structure for the malicious file.
        os.makedirs(os.path.dirname(final_path), exist_ok=True)

        # Write a dummy file to the destination. This simulates creating the font
        # and represents the arbitrary file write.
        with open(final_path, "w") as f:
            f.write("/* FONT DATA */\n")
            f.write("// This file represents the output of the build process.\n")

        print(f"Success: Wrote mock font to {final_path}")

    except Exception as e:
        print(f"Error: Could not write to file path. {e}")


def main(args=None):
    """
    Main function to mimic the fontTools.varLib command-line entry point.
    """
    parser = argparse.ArgumentParser(
        description="A mock varLib script demonstrating a file write vulnerability."
    )
    parser.add_argument(
        "designspace_path",
        help="Path to the .designspace file to process."
    )
    parser.add_argument(
        "-o", "--output-dir",
        default=".",
        help="Output directory for the generated fonts."
    )
    parsed_args = parser.parse_args(args)

    build_variable_font(parsed_args.designspace_path, parsed_args.output_dir)

if __name__ == "__main__":
    # To demonstrate the vulnerability:
    # 1. Create a directory, e.g., 'project/'.
    # 2. Create a malicious file named 'malicious.designspace' inside 'project/':
    #    <?xml version="1.0" encoding="UTF-8"?>
    #    <designspace format="4.0">
    #      <output path="../../pwned.py" />
    #    </designspace>
    # 3. Run from the parent directory of 'project/':
    #    python this_script.py project/malicious.designspace -o project/
    # 4. A file named 'pwned.py' will be created in the root directory,
    #    outside the intended 'project/' output directory.
    main()