Patched code sample

import os
import pathlib

# In a real application, this would be a configuration value.
# This represents the directory where playlists are allowed to be saved.
PLAYLISTS_BASE_DIR = "/data/playlists"


def update_playlist(playlist_filename: str, content: str) -> None:
    """
    Safely writes playlist content to a file, preventing path traversal.

    This function represents the patched logic for the 'music/playlists/update' API,
    addressing the arbitrary file write vulnerability.
    """
    # VULNERABILITY:
    # The original code might have done something like this, which is insecure:
    #   unsafe_path = os.path.join(PLAYLISTS_BASE_DIR, playlist_filename)
    #   with open(unsafe_path, "w") as f:
    #       f.write(content)
    # This allows a `playlist_filename` like "../../../tmp/evil.txt" to write
    # files outside of the intended PLAYLISTS_BASE_DIR.

    # --- FIX ---

    # 1. Use `os.path.basename` to strip any directory components from the input.
    # This is the primary defense against path traversal attacks like '../../'.
    # For example, `os.path.basename('../../../etc/passwd')` returns 'passwd'.
    safe_filename = os.path.basename(playlist_filename)

    # 2. Enforce the required '.m3u' file extension. The vulnerability description
    # notes that this check could be bypassed. The fix re-enforces it.
    if not safe_filename.endswith(".m3u"):
        # In a real-world scenario, you would raise a specific error here
        # to provide feedback to the user/API client.
        raise ValueError("Invalid playlist format. Filename must end with .m3u")

    # 3. Create a pathlib.Path object for the base directory for more robust and
    # secure path operations. resolve() creates a canonical, absolute path.
    safe_base_path = pathlib.Path(PLAYLISTS_BASE_DIR).resolve()

    # 4. Securely join the sanitized filename to the resolved base path.
    final_path = safe_base_path.joinpath(safe_filename)

    # 5. Perform the critical security check: Verify that the final resolved path
    # is a child of the safe base path. This is a redundant but crucial final
    # check to ensure the file is being written where it is expected.
    # `final_path.resolve()` is used to prevent any symbolic link trickery.
    try:
        # This check ensures that `safe_base_path` is a parent of `final_path`.
        # If `final_path` is outside `safe_base_path`, it will raise a ValueError.
        final_path.resolve().relative_to(safe_base_path)
    except ValueError:
        # This block is executed if the path is outside the allowed directory.
        # Log the attempt and raise an exception or return an error.
        # For example:
        #   log.warning(f"Path traversal attempt blocked for: {playlist_filename}")
        raise PermissionError("Path traversal attempt detected and blocked.")

    # 6. If all checks pass, it is safe to write the file.
    try:
        # Ensure parent directory exists before writing.
        final_path.parent.mkdir(parents=True, exist_ok=True)
        with open(final_path, "w", encoding="utf-8") as f:
            f.write(content)
        # print(f"Successfully wrote playlist to: {final_path}")
    except (IOError, OSError) as e:
        # Handle potential filesystem errors.
        # For example:
        #   log.error(f"Failed to write playlist {final_path}: {e}")
        raise IOError(f"Could not write to playlist file: {e}") from e