Vulnerable code sample

import os
import shutil

# This function simulates the vulnerable logic in asyncssh's scp.py before
# the fix. The core of the vulnerability is that a server-provided filename
# containing path traversal sequences ('../') is joined to a local path
# without being sanitized first.
def vulnerable_file_reception_logic(local_dest_dir, server_provided_filename, file_content):
    # The vulnerable operation: os.path.join processes the '../' sequence
    # from the untrusted 'server_provided_filename', allowing it to "escape"
    # the 'local_dest_dir'.
    final_path = os.path.join(local_dest_dir, server_provided_filename)

    # In a real scenario, the library would ensure parent directories exist.
    # This allows the attack to work even if the target path doesn't exist.
    os.makedirs(os.path.dirname(final_path), exist_ok=True)

    # The file is written to the traversed path, outside the intended directory.
    with open(final_path, 'w') as f:
        f.write(file_content)
    
    print(f"File write attempted to: {os.path.abspath(final_path)}")


# --- Demonstration of the vulnerability ---

# 1. Define the directory where the user intends to save the file.
intended_safe_dir = "downloads"

# 2. This is the malicious filename a compromised server would send.
# It uses '../' to traverse up one level from the intended directory.
malicious_filename = "../pwned_file.txt"

# 3. Clean up any artifacts from previous runs to ensure a clean test.
if os.path.exists(intended_safe_dir):
    shutil.rmtree(intended_safe_dir)
if os.path.exists("pwned_file.txt"):
    os.remove("pwned_file.txt")

# 4. Create the intended "safe" directory.
os.makedirs(intended_safe_dir)
print(f"Intended download directory created at: {os.path.abspath(intended_safe_dir)}")

# 5. Execute the vulnerable logic, simulating a file reception.
vulnerable_file_reception_logic(
    intended_safe_dir,
    malicious_filename,
    "This file was written outside the 'downloads' directory."
)

# 6. Verify the outcome.
print("-" * 20)
if os.path.exists("pwned_file.txt"):
    print("VULNERABILITY CONFIRMED: A file was created outside the intended directory.")
    print(f"Location: {os.path.abspath('pwned_file.txt')}")
else:
    print("Vulnerability could not be demonstrated.")

if not os.listdir(intended_safe_dir):
    print("The intended 'downloads' directory is correctly empty.")

# 7. Final cleanup.
shutil.rmtree(intended_safe_dir)
os.remove("pwned_file.txt")