Vulnerable code sample

import os
import zipfile
import tempfile

def vulnerable_media_import(zip_file_path):
    """
    A function that simulates the vulnerable archive import feature.
    It extracts all files from a ZIP archive to a temporary directory
    without validating the file paths, making it vulnerable to
    path traversal (Zip Slip).
    """
    # Create a temporary directory for extraction.
    temp_dir = tempfile.mkdtemp()

    # Open the user-provided ZIP file.
    with zipfile.ZipFile(zip_file_path, 'r') as zip_ref:
        # Iterate over each file in the ZIP archive.
        for member in zip_ref.infolist():
            # This is the vulnerable step:
            # The destination path is created by joining the temporary directory
            # with the filename from the ZIP file. The filename is not
            # sanitized or validated. A filename like '../../../../tmp/pwned.txt'
            # will resolve to a path outside of the 'temp_dir'.
            destination_path = os.path.join(temp_dir, member.filename)
            
            # To ensure file creation works even if parent dirs don't exist
            # in the malicious path.
            parent_dir = os.path.dirname(destination_path)
            if not os.path.exists(parent_dir):
                os.makedirs(parent_dir)

            # Extract the individual file by reading its data and writing
            # to the constructed destination path.
            with zip_ref.open(member) as source_file:
                with open(destination_path, "wb") as target_file:
                    target_file.write(source_file.read())