Vulnerable code sample

import os
import zipfile
import stat

# The following code is a conceptual representation of the vulnerability.
# It is not the literal source code from the 'wheel' library but is
# designed to demonstrate the exact logical flaw described. The flaw lies in
# using a sanitized path for file extraction but an unsanitized path for
# the subsequent permission-setting (chmod) operation.

def vulnerable_unpack(wheel_path, dest_dir):
    """
    Unpacks a wheel archive to a destination directory, demonstrating
    the permission modification vulnerability.
    """
    with zipfile.ZipFile(wheel_path, "r") as zf:
        for member in zf.infolist():
            # This is the raw, untrusted filename from the archive header.
            # An attacker can craft this to include path traversal components
            # like "../../../etc/passwd".
            original_filename = member.filename

            # --- EXTRACTION LOGIC (Relatively Safe) ---
            # The extraction logic first sanitizes the path to prevent
            # writing files outside the destination directory.
            # Note: zipfile.extract() has its own internal protections.
            # For demonstration, we explicitly show the check.
            target_path = os.path.realpath(os.path.join(dest_dir, original_filename))
            if not target_path.startswith(os.path.realpath(dest_dir)):
                # If the path tries to escape, the extraction is skipped.
                # However, the code continues to the vulnerable part below.
                pass
            else:
                # If the path is safe, the file is extracted.
                zf.extract(member, dest_dir)

            # --- PERMISSION-SETTING LOGIC (Vulnerable) ---
            # The vulnerability occurs here. The code reads the permission bits
            # from the archive and applies them using chmod.
            permissions = member.external_attr >> 16

            # It blindly trusts the 'original_filename' from the archive header
            # to build the path for the chmod operation.
            # It does NOT use the sanitized 'target_path' from above.
            vulnerable_path_for_chmod = os.path.join(dest_dir, original_filename)

            if permissions and not stat.S_ISDIR(member.external_attr):
                # This os.chmod() call is the core of the vulnerability.
                # If `original_filename` is "../../../etc/passwd", this call
                # will attempt to change the permissions of the actual /etc/passwd file
                # on the system, completely bypassing the extraction directory.
                try:
                    os.chmod(vulnerable_path_for_chmod, permissions)
                except FileNotFoundError:
                    # This error would occur if the file wasn't extracted because
                    # its path was unsafe. However, the crafted path could still
                    # point to a pre-existing system file, which would be modified.
                    pass