Patched code sample

import os
import shutil

# The configured base directory for the cache.
BASE_CACHE_DIR = "/opt/tautulli/cache"

def fixed_delete_cache_directory(directory_name: str):
    """
    Safely deletes a subdirectory within the cache, preventing path traversal.
    This represents the fixed logic for the vulnerability.
    """
    # Resolve the canonical path of the base directory to prevent symlink issues.
    real_base_dir = os.path.realpath(BASE_CACHE_DIR)

    # Create the full path to the user-requested directory.
    # At this point, the path is still potentially unsafe.
    # e.g., /opt/tautulli/cache/../../etc
    unsafe_path = os.path.join(real_base_dir, directory_name)

    # Resolve the full path to its canonical form, collapsing any '..' parts.
    # e.g., /opt/tautulli/cache/../../etc becomes /etc
    real_path_to_delete = os.path.realpath(unsafe_path)

    # --- VULNERABILITY FIX ---
    # Check if the fully resolved path is a sub-path of the real base directory.
    # os.path.commonpath will return the longest common sub-path. If it's not
    # equal to the base directory, the path has escaped. We also prevent
    # deletion of the base directory itself.
    if (os.path.commonpath([real_base_dir, real_path_to_delete]) == real_base_dir
            and real_path_to_delete != real_base_dir):

        # If the path is safe and is a directory, proceed with deletion.
        if os.path.isdir(real_path_to_delete):
            # In the actual application, this line would be active.
            # shutil.rmtree(real_path_to_delete)
            pass
    else:
        # The path is outside the allowed directory or is the base directory.
        # Silently block the operation and do nothing.
        pass