Patched code sample

import os
import pathlib

# In the actual application, this would be os.path.expanduser("~/.praison/rules")
# For this example, we use a local directory to represent the intended safe location.
BASE_RULES_DIR = pathlib.Path("./praison_rules").resolve()

def patched_create_rule(rule_name: str, content: str):
    """
    A simplified representation of the patched praisonai.rules.create function.
    
    This function demonstrates the fix for CVE-2026-44336 by ensuring
    the final file path is securely contained within the intended base directory.
    """
    if not rule_name or ".." in rule_name or "/" in rule_name:
        print(f"Error: Invalid characters in rule_name: '{rule_name}'")
        return

    # Construct the full path using the user-provided rule_name
    target_path = BASE_RULES_DIR / rule_name

    # --- THE FIX ---
    # 1. Resolve the path to its absolute, canonical form. This collapses
    #    any '..' sequences or symbolic links that might have bypassed the simple check.
    resolved_path = target_path.resolve()

    # 2. Check for path containment by verifying that the resolved path
    #    is a sub-path of the resolved base directory.
    #    The original code lacked this crucial check.
    try:
        resolved_path.relative_to(BASE_RULES_DIR)
    except ValueError:
        # This error is raised if `resolved_path` is not within `BASE_RULES_DIR`.
        print(f"Error: Path traversal attempt detected for rule_name: '{rule_name}'")
        return
    # --- END OF FIX ---

    # If the containment check passes, proceed with the file operation.
    try:
        # Ensure the base directory exists before writing.
        os.makedirs(BASE_RULES_DIR, exist_ok=True)
        with open(resolved_path, "w") as f:
            f.write(content)
        print(f"Success: Rule safely created at {resolved_path}")
    except IOError as e:
        print(f"Error: Could not write to file. {e}")