Patched code sample

import os
from pathlib import PurePosixPath

# This script demonstrates the logic used to fix the path traversal vulnerability
# (CVE-2023-39844, mistyped as CVE-2026-39844 in the prompt) in NiceGUI.

# The vulnerability existed because PurePosixPath was used to sanitize filenames.
# PurePosixPath only recognizes forward slashes ('/') as separators, allowing
# an attacker to use backslashes ('\') on Windows to bypass sanitization.


def vulnerable_path_construction(malicious_filename: str, upload_dir: str) -> str:
    """
    Simulates the vulnerable pattern prior to NiceGUI 3.10.0.
    The .name attribute does not sanitize backslashes.
    """
    # This is the flawed sanitization: it does not handle backslashes.
    sanitized_name = PurePosixPath(malicious_filename).name
    
    # The resulting path becomes vulnerable to traversal on Windows.
    return os.path.join(upload_dir, sanitized_name)


def fixed_path_construction(malicious_filename: str, upload_dir: str) -> str:
    """
    Demonstrates the fixed approach by using a robust sanitization function
    before constructing the path.
    """
    # The fix is to use a function that properly sanitizes the filename by
    # removing any characters that could represent a path on ANY OS. This is
    # done by whitelisting safe characters.
    sanitized_name = "".join(c for c in malicious_filename if c.isalnum() or c in "._-").strip()

    # The resulting path is now safe from traversal attacks.
    return os.path.join(upload_dir, sanitized_name)


if __name__ == "__main__":
    # An attacker's filename designed to write a file outside the target directory on a Windows system.
    malicious_input = r'..\..\..\Windows\System32\evil.txt'
    upload_directory = 'C:\\app\\uploads'

    # --- VULNERABLE DEMONSTRATION ---
    vulnerable_result = vulnerable_path_construction(malicious_input, upload_directory)
    
    print("--- DEMONSTRATION OF THE FIX ---")
    print(f"Malicious Filename: {malicious_input}\n")

    print("[VULNERABLE METHOD]")
    print(f"Sanitization via PurePosixPath.name: '{PurePosixPath(malicious_input).name}'")
    print(f"Resulting Path (on Windows):         '{os.path.normpath(vulnerable_result)}'")
    print("Analysis: The path resolves outside the 'uploads' directory, which is dangerous.\n")


    # --- FIXED DEMONSTRATION ---
    fixed_result = fixed_path_construction(malicious_input, upload_directory)
    
    print("[FIXED METHOD]")
    sanitized_for_print = "".join(c for c in malicious_input if c.isalnum() or c in "._-").strip()
    print(f"Sanitization via character whitelist: '{sanitized_for_print}'")
    print(f"Resulting Path (on Windows):          '{os.path.normpath(fixed_result)}'")
    print("Analysis: The path is safely contained within the 'uploads' directory.")