Vulnerable code sample

import os
from pathlib import Path

def _get_authorized_keys_path_vulnerable(path_token: str, username: str) -> Path:
    """
    Represents the vulnerable logic in AsyncSSH < 2.23.1 where
    'AuthorizedKeysFile' is processed.
    """

    # 1. Incomplete validation: The code blocks some directory traversal
    # characters but crucially misses '~' and '${...}' which are used for
    # shell-like expansion. This check happens before %u substitution.
    if '/' in path_token or '\\' in path_token or '..' in path_token:
        raise ValueError("Path contains invalid characters")

    # The path token is now incorrectly considered "safe".

    # 2. Unsafe Expansion: Later in the code flow, the "safe" token is
    # expanded, allowing an escape from the intended base directory.

    # First, substitute %u with the username
    path_after_user_sub = path_token.replace('%u', username)

    # Next, expand environment variables like ${HOME}
    path_after_env_expand = os.path.expandvars(path_after_user_sub)

    # Finally, expand the user's home directory ('~'). This is the step
    # that can turn a relative path into an absolute one, thereby
    # escaping any intended parent directory for authorized keys.
    final_path = Path(path_after_env_expand).expanduser()

    # The server would then use this `final_path`. If an attacker provided
    # a path like "~/.ssh/malicious_keys", `final_path` becomes an
    # absolute path to that file, bypassing the server's key directory.
    return final_path