Patched code sample

import os
from pathlib import Path


def save_extension_settings_securely(extension_name: str, file_path_str: str, contents: str, app_root: Path):
    """
    This function demonstrates the fixed logic for saving extension settings,
    addressing the vulnerability described in CVE-2023-35050.

    Args:
        extension_name: The name of the extension saving its settings.
        file_path_str: The user-provided string for the file path.
        contents: The content to be written to the settings file.
        app_root: The root directory of the application.
    """
    # Sanitize extension_name to prevent it from being used for path traversal.
    if '..' in extension_name or extension_name.startswith('/'):
        # In the actual application, this would raise an error to the user interface.
        print(f"Error: Invalid extension name '{extension_name}'.")
        return

    # Define the secure base directory where settings for this extension are allowed.
    # This confines file operations to the 'extensions/<extension_name>/' sub-directory.
    base_path = app_root / 'extensions' / extension_name

    # Construct the final file path by taking ONLY the filename part of the user input
    # and joining it to the secure base path. This strips any directory traversal
    # characters (e.g., '../') or absolute paths from the user-provided string.
    file_path = base_path / Path(file_path_str).name

    # --- START OF CRITICAL FIX ---

    # 1. Compare canonical paths to ensure the final path is inside the allowed directory.
    #    The .resolve() method gets the absolute path, preventing bypasses using symlinks or '..'.
    is_safe_directory = file_path.parent.resolve() == base_path.resolve()

    # 2. Enforce that the file extension must be '.json'.
    #    This prevents overwriting executable files like '.py' or other sensitive files.
    is_safe_extension = file_path.suffix == '.json'

    if not is_safe_directory or not is_safe_extension:
        # In the actual application, this would raise an error to the user interface.
        print(f"Security Error: Attempt to save to an invalid path or with an invalid extension: '{file_path}'")
        return

    # --- END OF CRITICAL FIX ---

    # If all security checks pass, the file can be written safely.
    try:
        os.makedirs(base_path, exist_ok=True)
        with open(file_path, 'w') as f:
            f.write(contents)
        print(f"Successfully and securely saved settings to: {file_path}")
    except IOError as e:
        print(f"Error writing to file: {e}")