Patched code sample

import re
from urllib.parse import unquote
import os

# This regex is a simplified representation of a check for unsafe path components.
# It looks for directory traversal attempts or absolute paths.
UNSAFE_PATH_REGEX = re.compile(r"\.\.[/\\]|[/\\]\.\.|^[/\\]|^[a-zA-Z]:[/\\]")

def fixed_nltk_data_load(resource_url: str):
    """
    A conceptual fix demonstrating how to prevent path traversal by
    decoding the URL path before validation, as described in CVE-2026-54293.
    """
    if not resource_url.startswith("nltk:"):
        raise ValueError(f"Unsupported resource URL: {resource_url}")

    path_component = resource_url[len("nltk:"):]

    # THE FIX:
    # 1. First, decode any URL-encoded characters (e.g., %2e, %2f).
    # This ensures that the security check sees the actual path components
    # an attacker is trying to use, preventing a "decode-after-check" flaw.
    decoded_path = unquote(path_component)

    # 2. Second, perform the security check on the now-decoded path.
    # An attack like '..%2f..%2fetc%2fpasswd' becomes '../etc/passwd',
    # which is now correctly caught by the regex.
    if UNSAFE_PATH_REGEX.search(decoded_path):
        raise ValueError(
            f"Path traversal or absolute path detected in '{decoded_path}'"
        )

    # If the check passes, the path is considered safe. In a real implementation,
    # it would be joined with a trusted base directory to load a file.
    # For example:
    #
    # from nltk.downloader import Downloader
    # downloader = Downloader()
    # safe_full_path = downloader.find(decoded_path)
    # with open(safe_full_path) as f:
    #     return f.read()

    # Placeholder for safe file loading logic
    pass