Patched code sample

import os
import pathlib
import tempfile
import shutil

def demonstrate_fix_for_path_traversal(base_install_dir: pathlib.Path, path_from_wheel: str):
    """
    Demonstrates the fix for a path traversal vulnerability by ensuring that a file
    path from a wheel archive resolves to a location safely inside the target
    installation directory.

    This logic is representative of the patch applied to Poetry in version 1.8.0
    to fix CVE-2024-34591 (which matches the provided description, despite the
    different CVE number and version in the prompt). The core of the fix is to
    resolve the full path and verify it is a sub-path of the intended destination.

    Args:
        base_install_dir: The root directory for installation (e.g., 'site-packages').
        path_from_wheel: An untrusted file path from the wheel archive.

    Raises:
        ValueError: If the path is determined to be malicious and attempts to
                    write outside the `base_install_dir`.
    """
    # In the vulnerable version, the path might be joined without validation:
    # vulnerable_path = base_install_dir / path_from_wheel
    # This would allow `../` to escape the base directory.

    # --- START OF THE FIX ---

    # Resolve the intended base directory to get a canonical, absolute path.
    resolved_base = base_install_dir.resolve()
    
    # Combine the base directory and the untrusted path component.
    candidate_path = resolved_base / path_from_wheel

    # 1. Resolve the combined path. The `resolve()` method will process any `../`
    #    components, simplifying `.../foo/../bar` to `.../bar`. It provides a
    #    canonical path that can be reliably checked. On some systems (like Windows),
    #    it can raise a RuntimeError for invalid `..` sequences.
    try:
        resolved_candidate = candidate_path.resolve()
    except (RuntimeError, FileNotFoundError):
        # A failure to resolve indicates a malformed or malicious path.
        raise ValueError(f"Path cannot be safely resolved: '{path_from_wheel}'")

    # 2. Check for containment. The `relative_to()` method will raise a `ValueError`
    #    if the path (`resolved_candidate`) is not located inside the directory
    #    specified by the argument (`resolved_base`). This is the crucial security check.
    try:
        resolved_candidate.relative_to(resolved_base)
    except ValueError:
        # If this exception is caught, the path is outside the security boundary.
        raise ValueError(f"Path traversal attempt detected: '{path_from_wheel}'")

    # --- END OF THE FIX ---

    # If both checks pass, the path is considered safe.
    print(f"[SAFE] Path '{path_from_wheel}' is contained within '{base_install_dir}'.")
    print(f"       It would be written to: {resolved_candidate}\n")
    # In a real installer, the file would be written to `resolved_candidate`.


if __name__ == '__main__':
    # Create a temporary directory to simulate a package installation environment.
    with tempfile.TemporaryDirectory() as tmpdir:
        # This simulates the target `site-packages` directory.
        install_root = pathlib.Path(tmpdir) / "venv" / "lib" / "python3.9" / "site-packages"
        install_root.mkdir(parents=True)

        print(f"Simulating installation into: {install_root}\n" + "="*80)

        # A list of paths as they might appear in a malicious wheel file.
        paths_to_test = [
            "my_package/code.py",                     # A standard, safe path.
            "my_package/data/resource.txt",           # A standard, safe nested path.
            "my_package/../evil.py",                  # An attempt to write into site-packages root.
            "../../../../../../tmp/malicious_file",   # A classic path traversal attack.
            "../../../../../../etc/passwd",           # An attack targeting a sensitive system file.
            os.path.abspath(__file__),                # An absolute path attack.
        ]

        for path in paths_to_test:
            try:
                demonstrate_fix_for_path_traversal(install_root, path)
            except ValueError as e:
                print(f"[BLOCKED] {e}\n")