Patched code sample

import tarfile
import os
import tempfile
import pathlib
import sys

# Note: The CVE-2025-8869 in the prompt is a placeholder for a future year.
# The described vulnerability, involving pip's fallback for tar extraction
# on Python versions without PEP 706, aligns with the real-world CVE-2023-5752.
# This code demonstrates the logic used to fix such a vulnerability.

def _is_within_directory(directory, target):
    """
    Safely checks if a target path is within a given directory.
    This is a key component of the fix to prevent path traversal.
    """
    abs_directory = os.path.abspath(directory)
    abs_target = os.path.abspath(target)
    prefix = os.path.commonprefix([abs_directory, abs_target])
    return prefix == abs_directory

def safe_tar_extract(tar_path, extract_dir):
    """
    Represents the fixed extraction logic for a tar archive.

    This function first inspects all members of the tar archive. It ensures
    that no file, directory, or symbolic link will be created outside of the
    intended `extract_dir`. If any member attempts a path traversal, it
    raises an exception, preventing the extraction.

    This mimics the patch applied to pip, which adds these safety checks
    to its fallback tar extraction code for older Python versions.
    """
    with tarfile.open(tar_path, "r:") as tar:
        # --- START OF THE FIX LOGIC ---
        # First, iterate and check all members before any extraction occurs.
        for member in tar.getmembers():
            member_path = os.path.join(extract_dir, member.name)

            # Check 1: Ensure the destination path of the member itself is safe.
            if not _is_within_directory(extract_dir, member_path):
                raise ValueError(
                    f"Attempted path traversal in member name: '{member.name}'"
                )

            # Check 2: If the member is a symlink or hard link, check its target.
            if member.islnk() or member.issym():
                # The link target path is relative to the location of the link itself
                link_source_dir = os.path.dirname(member_path)
                link_target_path = os.path.join(link_source_dir, member.linkname)

                if not _is_within_directory(extract_dir, link_target_path):
                    raise ValueError(
                        f"Symbolic link '{member.name}' points outside of "
                        f"extraction directory to '{member.linkname}'"
                    )
        # --- END OF THE FIX LOGIC ---

        # If all checks pass, it is safe to proceed with the extraction.
        # Note: Modern tarfile.extractall (with PEP 706) has a `filter`
        # argument that provides this functionality natively. This manual
        # loop represents the fallback implementation's fix.
        print("All members verified. Proceeding with safe extraction.")
        tar.extractall(path=extract_dir)
        print(f"Successfully and safely extracted archive to '{extract_dir}'")

def create_malicious_tar(tar_path, target_outside_file):
    """
    Creates a tar file containing a symbolic link that points outside
    the intended extraction root (a "path traversal" attack).
    """
    # Create a dummy safe file to include in the archive.
    safe_file_path = "safe_file.txt"
    with open(safe_file_path, "w") as f:
        f.write("This is a legitimate file.")

    # Create the tar archive.
    with tarfile.open(tar_path, "w") as tar:
        # Add the safe file.
        tar.add(safe_file_path)

        # Now, craft a malicious TarInfo object for a symbolic link.
        link_info = tarfile.TarInfo(name="malicious_link.txt")
        link_info.type = tarfile.SYMTYPE
        # This link points upwards from the extraction directory.
        # The goal is to make it resolve to `target_outside_file`.
        link_info.linkname = os.path.relpath(
            target_outside_file, start=os.path.dirname(tar_path) or '.'
        )
        # On Unix, a more direct attack might look like:
        # link_info.linkname = "../../../../../tmp/pwned_by_cve"
        tar.addfile(link_info)

    os.remove(safe_file_path)
    print(f"Created malicious tar file at '{tar_path}'")
    print(f"It contains a symlink pointing towards '{link_info.linkname}'")


if __name__ == "__main__":
    # Use a temporary directory for a self-contained, safe demonstration.
    with tempfile.TemporaryDirectory() as temp_dir:
        work_dir = pathlib.Path(temp_dir)
        malicious_tar_path = work_dir / "malicious.tar"
        extraction_dir = work_dir / "safe_extraction_target"
        
        # This is the file the attacker wants to create or overwrite.
        # It is intentionally outside the `extraction_dir`.
        outside_attack_target = work_dir / "pwned_file.txt"

        os.makedirs(extraction_dir)

        print(f"Demonstration Setup:")
        print(f"  Extraction Directory: {extraction_dir}")
        print(f"  Attack Target File:   {outside_attack_target}")
        print("-" * 60)

        # 1. Create the malicious tar file containing the traversal payload.
        create_malicious_tar(malicious_tar_path, outside_attack_target)
        print("-" * 60)

        # 2. Demonstrate the VULNERABLE behavior (for comparison).
        print(">>> Simulating VULNERABLE extraction (e.g., plain `tar.extractall`):")
        try:
            # The vulnerable call would not perform checks.
            with tarfile.open(malicious_tar_path) as tar:
                # This is the call that would be vulnerable in old versions.
                tar.extractall(path=extraction_dir)
            print("    VULNERABLE EXTRACTION SUCCEEDED.")
            if os.path.lexists(outside_attack_target):
                 print(f"    ATTACK SUCCESSFUL: Malicious file/link created at '{outside_attack_target}'")
            else:
                 # Depending on OS and pathing, the link might be broken but still created
                 if os.path.lexists(extraction_dir / "malicious_link.txt"):
                     print(f"    ATTACK PARTIALLY SUCCESSFUL: Symlink created inside extraction dir.")
                 else:
                     print("    Attack appears to have failed, but extraction was not prevented.")
        except Exception as e:
            print(f"    An unexpected error occurred during vulnerable simulation: {e}")
        print("-" * 60)


        # 3. Demonstrate the FIXED behavior using our safe function.
        print(">>> Demonstrating FIXED extraction with pre-extraction checks:")
        try:
            safe_tar_extract(malicious_tar_path, extraction_dir)
        except ValueError as e:
            print(f"    FIX WORKED: Extraction safely aborted as intended.")
            print(f"    Reason: {e}")
        print("-" * 60)

        # 4. Verify that the attack was ultimately prevented by the fix.
        print(">>> Final Verification:")
        if not os.path.lexists(outside_attack_target):
            print(f"    SUCCESS: The file/link at '{outside_attack_target}' was NOT created.")
        else:
            print(f"    FAILURE: The vulnerable simulation created a file at '{outside_attack_target}'.")