Vulnerable code sample

import os
import subprocess
import shutil

# This is a mock function to simulate the output of an external '7z' command.
# In a real-world scenario, this would be a `subprocess.run` call.
# The simulated output contains a malicious path designed for traversal.
def _get_mock_7z_listing_output():
    """
    Simulates the output of `7z l -p<password> <archive_name>` for an archive
    containing a path traversal entry.
    The key is the line with '../../../../../../tmp/file_to_be_deleted.txt'.
    """
    return """
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21

Scanning the drive for archives:
1 file, 12345 bytes (13 KiB)

Listing archive: malicious_archive.7z

--
Path = malicious_archive.7z
Type = 7z
Headers Size = 256
Solid = -
Blocks = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2023-10-27 10:00:00 .....           50           50  a_legitimate_file.txt
2023-10-27 10:00:00 .....           50           50  ../../../../../../tmp/file_to_be_deleted.txt
------------------- ----- ------------ ------------  ------------------------
2023-10-27 10:00:00               100          100  2 files, 0 folders
"""

def vulnerable_password_verification(extraction_dir):
    """
    This function represents the vulnerable logic in pyLoad before the fix.
    It processes archive entries for password verification and is susceptible
    to path traversal, leading to arbitrary file deletion.
    """
    print(f"[+] Simulating password verification on a malicious archive...")
    
    # In the original code, this would be a real subprocess call, e.g.:
    # result = subprocess.run(['7z', 'l', ...], capture_output=True, text=True)
    # Here, we use a mock function to provide the malicious output directly.
    result_stdout = _get_mock_7z_listing_output()
    
    # The code parses the output to get the list of file entries.
    file_entries = []
    in_file_list = False
    for line in result_stdout.strip().split('\n'):
        if line.startswith('-------------------'):
            in_file_list = not in_file_list
            continue
        if in_file_list and len(line.split()) > 5:
            # A simplistic parser to get the file name from the end of the line.
            entry_name = ' '.join(line.split()[5:])
            file_entries.append(entry_name)

    print(f"[+] Parsed file entries from archive listing: {file_entries}")

    # THE VULNERABILITY:
    # The code iterates through the parsed entry names and uses them to
    # construct file paths for operations, without sanitizing or constraining them.
    for entry_name in file_entries:
        # The 'entry_name' is trusted completely.
        # When entry_name is '../../../../../../tmp/file_to_be_deleted.txt',
        # os.path.join will create a path outside of the 'extraction_dir'.
        unsafe_path = os.path.join(extraction_dir, entry_name)
        
        # The CVE describes arbitrary file deletion during this process.
        # We simulate this by checking if the path exists and then deleting it.
        # In a real attack, this path points to a critical file the attacker wants to delete.
        if os.path.lexists(unsafe_path):
            print(f"[!] VULNERABILITY TRIGGERED: Malicious entry '{entry_name}' resolved to '{os.path.abspath(unsafe_path)}'.")
            print(f"[!] This path is outside the intended extraction directory.")
            print(f"[!] Deleting file: {unsafe_path}")
            os.remove(unsafe_path)
            
if __name__ == '__main__':
    # --- Setup for Demonstration ---
    
    # 1. Define a safe extraction directory.
    EXTRACTION_DIR = os.path.abspath("./safe_extraction_dir")
    
    # 2. Define the path to a file that should NOT be deleted.
    # This file is outside the extraction directory.
    # On non-Unix systems, you may need to change '/tmp/' to a valid temp path.
    TARGET_FILE_PATH = "/tmp/file_to_be_deleted.txt"

    # 3. Clean up previous runs and set up the environment.
    if os.path.exists(EXTRACTION_DIR):
        shutil.rmtree(EXTRACTION_DIR)
    os.makedirs(EXTRACTION_DIR)

    # 4. Create the target file that the exploit will delete.
    with open(TARGET_FILE_PATH, "w") as f:
        f.write("This is an important file that should not be deleted.")

    print("--- CVE-2026-32808 Demonstration ---")
    print(f"[*] Safe extraction directory created at: {EXTRACTION_DIR}")
    print(f"[*] Target file created at: {TARGET_FILE_PATH}")
    print(f"[*] Target file exists before vulnerable function call? {os.path.exists(TARGET_FILE_PATH)}")
    print("-" * 40)

    # --- Run the Vulnerable Code ---
    vulnerable_password_verification(EXTRACTION_DIR)

    print("-" * 40)
    # --- Verify the Outcome ---
    print("[*] Vulnerable function has finished.")
    print(f"[*] Target file exists after vulnerable function call? {os.path.exists(TARGET_FILE_PATH)}")

    if not os.path.exists(TARGET_FILE_PATH):
        print("\n[SUCCESS] The vulnerability was successfully demonstrated. The file outside the extraction directory was deleted.")
    else:
        print("\n[FAILURE] The demonstration failed. The target file was not deleted.")

    # --- Cleanup ---
    if os.path.exists(EXTRACTION_DIR):
        shutil.rmtree(EXTRACTION_DIR)
    print("[*] Cleaned up extraction directory.")