Patched code sample

import os
import shutil
import tempfile

# The provided CVE-2026-24486 is fictitious, but its description matches a real
# vulnerability, CVE-2022-24786, in the `python-multipart` library.
# This code demonstrates the logic that fixes that path traversal vulnerability.

def get_secure_path(upload_dir, filename):
    """
    Represents the patched logic. It sanitizes the filename to prevent
    directory traversal before joining it with the upload directory.

    Args:
        upload_dir (str): The target directory for uploads.
        filename (str): The untrusted, user-provided filename.

    Returns:
        str: A safe, calculated path for the file.
    """
    # The core of the fix: `os.path.basename()` strips any directory
    # components from the filename provided by an attacker.
    # For example, an input of '../../etc/passwd' becomes 'passwd'.
    sanitized_filename = os.path.basename(filename)
    
    # The sanitized filename is then safely joined to the intended directory.
    # `os.path.join` will now correctly place the file inside the `upload_dir`.
    return os.path.join(upload_dir, sanitized_filename)

def main():
    """
    A self-contained demonstration of the vulnerability and the fix.
    """
    # 1. Create a temporary directory to simulate a web server's upload folder.
    # This represents the `UPLOAD_DIR` setting.
    upload_dir = tempfile.mkdtemp(prefix="safe_uploads_")
    print(f"Created temporary upload directory: {upload_dir}")

    try:
        # 2. Define a malicious filename crafted by an attacker.
        # This filename attempts to write a file outside of the `upload_dir`.
        malicious_filename = "../../../pwned.txt"
        print(f"Using malicious filename:       '{malicious_filename}'")
        print("-" * 40)

        # 3. VULNERABLE LOGIC (for comparison)
        # In the vulnerable version, the path is constructed without sanitization.
        vulnerable_path = os.path.join(upload_dir, malicious_filename)
        resolved_vulnerable_path = os.path.abspath(vulnerable_path)
        print(f"Vulnerable path resolves to:    {resolved_vulnerable_path}")

        # 4. FIXED LOGIC
        # The patched version uses the secure function to sanitize the filename.
        secure_path = get_secure_path(upload_dir, malicious_filename)
        resolved_secure_path = os.path.abspath(secure_path)
        print(f"Secure path resolves to:        {resolved_secure_path}")
        print("-" * 40)

        # 5. VERIFICATION
        is_path_safe = resolved_secure_path.startswith(os.path.abspath(upload_dir))
        print(f"Verification: Is the secure path safely inside the upload directory? {is_path_safe}")
        
        assert is_path_safe, "Fix failed: The secure path is outside the upload directory!"

        # To complete the demonstration, we write to the secure path.
        with open(secure_path, "w") as f:
            f.write("This file was written safely.")
        
        print(f"Successfully wrote test file to the secure location.")
        print(f"File exists: {os.path.exists(secure_path)}")

    finally:
        # 6. Clean up the temporary directory and its contents.
        print("\nCleaning up temporary directory...")
        shutil.rmtree(upload_dir)
        print("Cleanup complete.")

if __name__ == "__main__":
    main()