Patched code sample

import zipfile
import os
import io

def secure_extract_email_attachment(archive_content: bytes, destination_dir: str):
    """
    Safely extracts a ZIP archive, representing a fix for a "Matryoshka Mail"
    style path traversal vulnerability (CVE-2026-13014).

    The vulnerability occurs when an application extracts an archive without
    validating the file paths of its members. An attacker can craft an archive
    with file paths like "../../../app/settings.py" to overwrite critical files.

    The fix is to resolve the real path of each member file before extraction
    and ensure it is strictly within the intended destination directory.
    """
    # Ensure the destination is a real, absolute path for robust comparison.
    real_destination = os.path.realpath(destination_dir)

    with zipfile.ZipFile(io.BytesIO(archive_content)) as zf:
        for member_info in zf.infolist():
            # Prevent extraction of directories, which can be part of the attack.
            if member_info.is_dir():
                continue

            target_path = os.path.join(real_destination, member_info.filename)

            # Resolve the absolute, canonical path of the file to be extracted.
            # This correctly handles ".." path components (e.g., /tmp/../etc/passwd).
            real_target_path = os.path.realpath(target_path)

            # --- THE VULNERABILITY FIX ---
            #
            # The vulnerable code would lack this check, allowing a file to be
            # written outside the `real_destination` directory.
            #
            # This check ensures that the resolved path of the file to be
            # extracted starts with the path of the destination directory.
            if not real_target_path.startswith(real_destination + os.sep):
                # Path traversal attempt detected. Log and reject the file.
                # For this example, we raise an exception to stop processing.
                raise PermissionError(
                    f"Path traversal attempt blocked for malicious file: {member_info.filename}"
                )
            # --- END OF FIX ---

            # If the check passes, the path is safe. Extract the individual file.
            # We extract file-by-file rather than using extractall() to ensure
            # each member path is explicitly validated.
            zf.extract(member_info, path=real_destination)