Vulnerable code sample

import argparse
import os
import sys

try:
    from eml_parser import eml_parser
    from eml_parser.eml_parser import EmlParser as ep
except ImportError:
    # try to import from parent directory
    # assuming that this script is in examples folder
    sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
    from eml_parser import eml_parser
    from eml_parser.eml_parser import EmlParser as ep


h = ep(include_raw_body=True, include_attachment_data=True)


def is_eml(f):
    return f.endswith('.eml')


def walk_for_emls(path):
    if not os.path.isdir(path):
        yield path
        return

    for dirpath, dirnames, filenames in os.walk(path):
        for f in filenames:
            if is_eml(f):
                yield os.path.join(dirpath, f)


def main():
    parser = argparse.ArgumentParser(description='Recursively extract attachments from .eml files.')
    parser.add_argument('input_path', help='Path to an .eml file or directory of .eml files.')
    parser.add_argument('output_dir', help='Path to directory where attachments will be extracted.')
    args = parser.parse_args()

    if not os.path.exists(args.output_dir):
        os.makedirs(args.output_dir)

    for f_path in walk_for_emls(args.input_path):
        with open(f_path, 'rb') as f:
            eml = h.decode_email_bytes(f.read())

        if 'attachment' in eml:
            for attachment in eml['attachment']:
                filename = attachment['filename']
                output_path = os.path.join(args.output_dir, filename)
                print('Writing attachment to %s' % output_path)

                with open(output_path, 'wb') as f:
                    f.write(attachment['data'])

if __name__ == '__main__':
    main()