Vulnerable code sample

import os

def create_vulnerable_package_path(package_name):
    """
    Represents the vulnerable code in pyLoad prior to 0.5.0b3.dev100.
    It uses an insufficient string replacement for sanitization, which can
    be bypassed for path traversal.
    """
    # Base directory where packages are supposed to be saved.
    base_download_dir = "/tmp/pyload/downloads"

    # VULNERABLE LOGIC: A naive, single-pass replacement of "../".
    # An input like "../../etc/passwd" becomes "../etc/passwd" after
    # this replacement, as only the first instance is removed.
    sanitized_name = package_name.replace("../", "")

    # The resulting path is constructed with the partially sanitized name.
    final_path = os.path.join(base_download_dir, sanitized_name)

    # When the path is resolved, the remaining "../" allows traversal
    # out of the intended base directory.
    return os.path.abspath(final_path)


# --- Demonstration of the vulnerability ---

# Attacker-controlled input designed to bypass the weak sanitization.
# This is equivalent to "....//" mentioned in the CVE.
malicious_package_name = "../../etc/passwd"

# The vulnerable function generates a path that escapes the intended directory.
exploited_path = create_vulnerable_package_path(malicious_package_name)

# This will print a path outside of "/tmp/pyload/downloads",
# demonstrating the successful path traversal.
# e.g., on Linux, it will likely print "/tmp/etc/passwd".
print(exploited_path)