Vulnerable code sample

import os
import tarfile
import io

# In a real scenario, these would be parts of a larger system state.
# We simulate them here for clarity.
# a) The package manager's database of what files belong to which package.
package_database = {}
# b) The simulated root filesystem.
mock_filesystem_root = "MOCK_FS_ROOT"


def create_malicious_package(package_name, manifest_files, extra_untracked_file):
    """
    Creates a fake .tar.gz archive in memory representing a malicious package.
    The archive contains all files, but the included metadata (manifest)
    only lists a subset of them.
    """
    # Create the manifest content (e.g., a simple 'files.xml' or similar)
    manifest_content = "<Files>\n"
    for f in manifest_files:
        manifest_content += f"    <File path='{f}'/>\n"
    manifest_content += "</Files>"

    # Create an in-memory tar archive
    tar_buffer = io.BytesIO()
    with tarfile.open(fileobj=tar_buffer, mode="w:gz") as tar:
        # Add the manifest file to the archive
        manifest_info = tarfile.TarInfo(name="manifest.xml")
        manifest_info.size = len(manifest_content.encode('utf-8'))
        tar.addfile(manifest_info, io.BytesIO(manifest_content.encode('utf-8')))

        # Add the legitimate files to the archive
        for file_path in manifest_files:
            file_info = tarfile.TarInfo(name=file_path)
            file_data = b"legit content"
            file_info.size = len(file_data)
            tar.addfile(file_info, io.BytesIO(file_data))

        # Add the malicious, untracked file to the archive
        malicious_info = tarfile.TarInfo(name=extra_untracked_file)
        malicious_data = b"#!/bin/sh\n# I am a malicious script"
        malicious_info.size = len(malicious_data)
        tar.addfile(malicious_info, io.BytesIO(malicious_data))

    tar_buffer.seek(0)
    return tar_buffer


def vulnerable_install_package(package_name, package_archive):
    """
    This function simulates the vulnerable installation process of `eopkg` < 4.4.0.
    
    THE VULNERABILITY:
    1. It extracts *all* files from the archive onto the filesystem.
    2. It reads a manifest *from within the package* to decide which files to
       track in its database.
    
    This creates a discrepancy: a file can be on the system but not known to the
    package manager.
    """
    print(f"--- Installing package '{package_name}' ---")

    # This part simulates parsing the manifest to know what to track.
    # In a real implementation, this would be more robust (e.g., parsing XML).
    tracked_files = []
    
    # We re-open the archive to process it.
    package_archive.seek(0)
    with tarfile.open(fileobj=package_archive, mode="r:gz") as tar:
        
        # STEP 1 (Vulnerable): Extract ALL members from the tarball to the filesystem.
        # This blindly trusts the archive's contents.
        print("Vulnerable Action: Extracting all files from archive to filesystem...")
        for member in tar.getmembers():
            # Skip the manifest itself from being extracted.
            if member.name == "manifest.xml":
                # Read the manifest to determine which files to track later.
                manifest_data = tar.extractfile(member).read().decode('utf-8')
                # A crude way to parse our simple manifest.
                for line in manifest_data.splitlines():
                    if "<File path='" in line:
                        path = line.split("'")[1]
                        tracked_files.append(path)
                continue

            # Simulate file extraction
            dest_path = os.path.join(mock_filesystem_root, member.name.lstrip('/'))
            print(f"  -> Placing '{member.name}' on filesystem.")
            # In a real scenario, this would write the file.
            # os.makedirs(os.path.dirname(dest_path), exist_ok=True)
            # with open(dest_path, "wb") as f:
            #     f.write(tar.extractfile(member).read())

    # STEP 2 (Vulnerable): Update the package database using ONLY the files
    # listed in the package's own manifest.
    print("\nVulnerable Action: Updating package database based on manifest...")
    package_database[package_name] = tracked_files
    print("Installation complete.")


def list_package_files(package_name):
    """
    Simulates `lseopkg`, which lists files for an installed package.
    It relies entirely on the package_database.
    """
    print(f"\n--- Running 'lseopkg {package_name}' (listing tracked files) ---")
    if package_name in package_database:
        files = package_database[package_name]
        if files:
            for f in files:
                print(f"  {f}")
        else:
            print("  (No files tracked for this package)")
    else:
        print(f"  Package '{package_name}' not found in database.")


if __name__ == '__main__':
    # 1. Define the files for our malicious package.
    PKG_NAME = "malicious-app-1.0"
    LEGIT_FILES = [
        "/usr/bin/malicious-app",
        "/usr/share/doc/malicious-app/readme.txt"
    ]
    # This file will be in the archive but NOT in the manifest.
    HIDDEN_MALICIOUS_FILE = "/etc/cron.daily/backdoor-script"

    # 2. Create the malicious package in memory.
    malicious_pkg_archive = create_malicious_package(
        PKG_NAME,
        LEGIT_FILES,
        HIDDEN_MALICIOUS_FILE
    )

    # 3. Use the vulnerable function to install the package.
    vulnerable_install_package(PKG_NAME, malicious_pkg_archive)

    # 4. Use the listing tool to see what the user would see.
    # The output will NOT show the `backdoor-script`.
    list_package_files(PKG_NAME)

    # 5. Show the discrepancy.
    print("\n\n--- DEMONSTRATION OF VULNERABILITY ---")
    print("Files the package manager *thinks* it installed:")
    for f in package_database.get(PKG_NAME, []):
        print(f"  -> {f}")
    
    print("\nFiles *actually* placed on the filesystem (simulated):")
    print(f"  -> {LEGIT_FILES[0]}")
    print(f"  -> {LEGIT_FILES[1]}")
    print(f"  -> {HIDDEN_MALICIOUS_FILE}  <-- VULNERABILITY! This file is hidden from the package manager.")