Vulnerable code sample

import io
import pyzipper

# This code requires a vulnerable version of pyzipper (e.g., 0.3.0).
# pip install pyzipper==0.3.0

def vulnerable_create_zip_with_lzma(password):
    """
    Demonstrates the vulnerability by creating an AES-encrypted zip file
    using LZMA compression with a vulnerable pyzipper version. The bug
    causes the library to select the AE-1 encryption format instead of the
    intended AE-2, exposing the CRC32 checksum in the header.
    """
    in_memory_zip = io.BytesIO()
    
    # The vulnerability occurs when AES encryption is used with LZMA compression.
    with pyzipper.AESZipFile(in_memory_zip, 'w',
                             compression=pyzipper.ZIP_LZMA,
                             encryption=pyzipper.WZ_AES) as zf:
        
        # Set the password for encryption.
        zf.setpassword(password)
        
        # Add a small, low-entropy file. The exposed CRC32 of this plaintext
        # makes a brute-force attack feasible.
        zf.writestr('file.txt', b'123')
        
    return in_memory_zip.getvalue()

# --- Execution ---
# Create a password-protected zip file using the vulnerable logic.
password = b"secret"
zip_data = vulnerable_create_zip_with_lzma(password)

# To verify the vulnerability, one would inspect the created zip_data.
# The 'extra field' for 'file.txt' would show the AES vendor version as 0x0001 (AE-1)
# instead of the correct 0x0002 (AE-2) for LZMA, and the CRC32 (0x884863d2 for '123')
# would be present in plaintext in the central directory header for the file.
# For example, a hex editor would reveal the CRC value in the file's header.
# (Verification step is not shown in this code).