Vulnerable code sample

import os

# This code is a representation of the vulnerable logic found in
# patool < 4.0.5 in patoolib/programs/py_tarfile.py.
# The vulnerability is in the is_within_directory function.

def is_within_directory(directory, target):
    """
    Vulnerable containment check. It uses os.path.commonprefix for a
    string-based comparison, which can be fooled by a crafted path.
    For example, if directory is '/tmp/extract', a target path that
    resolves to '/tmp/extract_evil/file' would pass this check.
    """
    abs_directory = os.path.abspath(directory)
    abs_target = os.path.abspath(target)

    prefix = os.path.commonprefix([abs_directory, abs_target])
    
    return prefix == abs_directory

def safe_extract(member_name, extract_dir):
    """
    A simplified function demonstrating how the vulnerable check is used.
    A malicious 'member_name' from an archive (e.g.,
    '../my_archive_traversal/pwned.txt') could bypass the check.
    """
    dest_path = os.path.join(extract_dir, member_name)

    if not is_within_directory(extract_dir, dest_path):
        # This check is intended to prevent path traversal but is flawed.
        raise Exception("Path traversal attempt detected.")

    # In a real scenario, the file would be written to 'dest_path' here,
    # potentially outside of the intended 'extract_dir'.
    # For example:
    # with open(dest_path, 'wb') as f:
    #     f.write(b'malicious content')
    return