Patched code sample

import tarfile
import os
import io

def create_malicious_tar(filename="malicious.tar.gz", member_name="C:/windows/temp/pwned.txt"):
    """Creates a sample malicious tar.gz file for demonstration."""
    tar_buffer = io.BytesIO()
    with tarfile.open(fileobj=tar_buffer, mode="w:gz") as tar:
        file_content = b"malicious content"
        tarinfo = tarfile.TarInfo(name=member_name)
        tarinfo.size = len(file_content)
        tar.addfile(tarinfo, io.BytesIO(file_content))
    
    with open(filename, "wb") as f:
        f.write(tar_buffer.getvalue())

def safe_extract_archive(tar_path: str, destination_dir: str):
    """
    Safely extracts a tar archive, preventing path traversal and absolute paths.
    This represents the fix for the described vulnerability.
    """
    # Resolve the destination directory to an absolute path to prevent ambiguity.
    real_destination_dir = os.path.realpath(destination_dir)

    with tarfile.open(tar_path, "r:*") as tar:
        for member in tar.getmembers():
            # Skip directories, they are created implicitly by file extraction.
            if not member.isfile():
                continue

            # Build the full, potential destination path for the member.
            member_dest_path = os.path.join(real_destination_dir, member.name)
            
            # Resolve the real path of the member, collapsing any ".." or absolute paths.
            real_member_dest_path = os.path.realpath(member_dest_path)

            # THE FIX:
            # Check if the resolved path of the member is within the intended
            # destination directory. This prevents both absolute paths (e.g., "C:/...")
            # and directory traversal attacks (e.g., "../...").
            if os.path.commonpath([real_destination_dir, real_member_dest_path]) == real_destination_dir:
                tar.extract(member, path=destination_dir)
            else:
                print(f"[SECURITY] Skipped potentially unsafe member: {member.name}")

if __name__ == '__main__':
    # --- Demonstration ---
    
    # 1. Define paths for the demonstration.
    malicious_archive_name = "malicious_absolute_path.tar.gz"
    safe_extraction_path = "safe_output"
    
    # 2. Create a sample malicious archive with a Windows absolute path.
    # This simulates the file that would trigger the vulnerability.
    create_malicious_tar(
        filename=malicious_archive_name,
        member_name="C:/windows/temp/pwned_by_cve.txt"
    )

    # 3. Create the intended extraction directory if it doesn't exist.
    os.makedirs(safe_extraction_path, exist_ok=True)
    
    print(f"Attempting to extract '{malicious_archive_name}' into '{safe_extraction_path}'...")

    # 4. Use the fixed (safe) extraction function.
    safe_extract_archive(malicious_archive_name, safe_extraction_path)
    
    print("\nExtraction finished.")
    print(f"Check the contents of the '{safe_extraction_path}' directory.")
    print("The malicious file should NOT have been written to C:/windows/temp.")

    # Clean up created files
    os.remove(malicious_archive_name)
    if not os.listdir(safe_extraction_path):
        os.rmdir(safe_extraction_path)