Patched code sample

import re
import os
from dataclasses import dataclass, field
from typing import FrozenSet


# This example represents the logic used to fix the vulnerability. The fix is
# applied during the initialization of a configuration object, before the
# value is ever used to construct a cache file path.

@dataclass
class BlackMode:
    """A simplified representation of Black's configuration object."""

    # This field holds the value from the `--python-cell-magics` option.
    python_cell_magics: FrozenSet[str] = field(default_factory=frozenset)
    # Other configuration options would be here.

    def __post_init__(self) -> None:
        """
        This method is automatically called after the object is created.
        It contains the sanitization logic that constitutes the fix.
        """
        if self.python_cell_magics:
            # THE FIX:
            # The original code used the `python_cell_magics` value in a
            # process that determined the cache filename. This new code
            # sanitizes the input by replacing path separators ('/' and '\')
            # with an underscore. This prevents path traversal.
            # The original commit comment:
            # "Sort for stability, then check for slashes. This is paranoid and
            # probably not required, but it's better to be safe."
            self.python_cell_magics = frozenset(
                sorted(
                    re.sub(r"[/\\]", "_", magic) for magic in self.python_cell_magics
                )
            )


# --- Demonstration of the fix ---

def get_cache_path_vulnerable(magics_input: str) -> str:
    """Simulates the vulnerable behavior of creating a cache path."""
    # VULNERABLE: The input is used directly in the path.
    file_name = f"black-cache-{magics_input}.bin"
    return os.path.join("/tmp/black/cache", file_name)


def get_cache_path_fixed(mode: BlackMode) -> str:
    """Simulates the fixed behavior using the sanitized configuration."""
    # FIXED: The input from the Mode object has already been sanitized.
    # We join the frozenset for filename creation.
    magics_string = "-".join(mode.python_cell_magics)
    file_name = f"black-cache-{magics_string}.bin"
    return os.path.join("/tmp/black/cache", file_name)


if __name__ == "__main__":
    # An attacker controls this input, attempting a path traversal attack.
    malicious_input = "../../../etc/passwd"
    user_provided_magics = frozenset({malicious_input})

    # 1. Demonstrate the vulnerable path construction (for comparison)
    vulnerable_path = get_cache_path_vulnerable(malicious_input)
    print(f"Vulnerable path:  {vulnerable_path}")
    print(f"Normalized path:  {os.path.normpath(vulnerable_path)}\n")


    # 2. Demonstrate the fix
    # The fix is applied inside the BlackMode's __post_init__ upon creation.
    fixed_mode = BlackMode(python_cell_magics=user_provided_magics)

    # The `python_cell_magics` attribute is now sanitized.
    print(f"Sanitized magics in config object: {fixed_mode.python_cell_magics}")

    # The sanitized value is then used, preventing the traversal.
    secure_path = get_cache_path_fixed(fixed_mode)
    print(f"Secure path:      {secure_path}")
    print(f"Normalized path:  {os.path.normpath(secure_path)}")