Patched code sample

import os

def get_safe_package_path(download_dir, subdir, pkg_id):
    """
    Constructs a safe path for an NLTK package, preventing path traversal.

    This function demonstrates the fix for the vulnerability (originally referenced
    by commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a in NLTK), which
    involves validating 'subdir' and 'pkg_id' components before joining them
    into a file path. The vulnerable version of the code would join these
    components without validation, allowing path traversal attacks.

    Args:
        download_dir (str): The base directory for all NLTK data.
        subdir (str): The subdirectory for the package, from a remote XML index.
        pkg_id (str): The package ID, from a remote XML index.

    Returns:
        str: The full, safe path for the package directory.

    Raises:
        ValueError: If a malicious path component (e.g., '..', '/', or '\')
                    is detected in `subdir` or `pkg_id`.
    """
    # --- Start of the vulnerability fix ---
    # The core of the fix is to explicitly check the 'subdir' and 'pkg_id'
    # strings to ensure they are simple names and do not contain any
    # directory separators or parent directory references before use.

    # 1. Validate the 'subdir' component from the remote index.
    # It must not contain path separators ('/' or '\') or be '..'.
    if subdir and (
        os.path.sep in subdir
        or (os.path.altsep and os.path.altsep in subdir)
        or subdir == ".."
    ):
        raise ValueError(
            f"Malicious path component detected in subdir: {subdir!r}"
        )

    # 2. Validate the 'id' component from the remote index.
    # It must also not contain path separators or be '..'.
    if (
        os.path.sep in pkg_id
        or (os.path.altsep and os.path.altsep in pkg_id)
        or pkg_id == ".."
    ):
        raise ValueError(f"Malicious path component detected in id: {pkg_id!r}")

    # --- End of the vulnerability fix ---

    # If validation passes, it is now safe to construct the path.
    # The vulnerable code would perform this step without the checks above.
    path_components = [download_dir]
    if subdir:
        path_components.append(subdir)
    path_components.append(pkg_id)

    # The os.path.join is now safe to use because its inputs were sanitized.
    safe_path = os.path.join(*path_components)

    return safe_path