Patched code sample

This code example represents the corrected path validation logic introduced in Dulwich to fix the vulnerability. The key part of the fix was to explicitly disallow backslashes (`\`) in path components, which prevents directory traversal on Windows, and to enforce other strict NTFS filename rules that were previously not checked correctly.

```python
import re

# A set of reserved names on Windows, case-insensitive.
_RESERVED_NTFS_NAMES = {
    "CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4",
    "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3",
    "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
}

# Regex for characters that are invalid in Windows filenames,
# including control characters from \x00 to \x1f.
_INVALID_NTFS_CHARS_RE = re.compile(r'[\x00-\x1f"<>|?*]')

def is_valid_ntfs_path_component(name: bytes) -> bool:
    """
    Validates a path component against Windows (NTFS) filesystem constraints.

    This function represents the core logic added to fix CVE-2022-42005.
    It prevents path traversal and the creation of illegal filenames on Windows
    by performing several checks that were previously missing or incorrect.

    Args:
        name: The path component (filename or directory name) as bytes.

    Returns:
        True if the name is valid for an NTFS filesystem, False otherwise.
    """
    # 1. FIX: Disallow backslashes in path components to prevent directory
    # traversal on Windows (e.g., a file named ".git\hooks\pre-commit").
    if b"\\" in name:
        return False

    # For subsequent checks, decode the byte string to a string.
    try:
        name_str = name.decode("utf-8")
    except UnicodeDecodeError:
        return False # Invalid UTF-8 is not a valid path component.

    # 2. FIX: Reject characters that are explicitly invalid in NTFS filenames.
    if _INVALID_NTFS_CHARS_RE.search(name_str):
        return False

    # 3. FIX: Reject names that end with a dot or a space.
    if name_str.endswith((" ", ".")):
        return False

    # 4. FIX: Reject reserved device names (e.g., "CON", "PRN", "LPT1").
    # The check is case-insensitive and also handles names with trailing dots
    # (e.g., "CON.").
    base_name = name_str.rstrip(".")
    if base_name.upper() in _RESERVED_NTFS_NAMES:
        return False

    return True

# Example of how the fixed validator would be used:
# A malicious repository might try to create a file named '..\.git\hooks\pre-commit'
# On Windows, the path component is interpreted at the '\'
malicious_path_component = b".git\\hooks\\pre-commit"
benign_path_component = b"my-file.txt"

# In the fixed version of Dulwich, this check would be enabled by default.
assert is_valid_ntfs_path_component(benign_path_component) is True
assert is_valid_ntfs_path_component(malicious_path_component) is False