Patched code sample

import os
import sys
import importlib

def run_self_update_check():
    """
    Simulates pip's self-update check, which imports a common module.
    In the fixed version, this runs before any new packages are on the path.
    """
    print("1. Running self-update check...")
    try:
        # This import safely resolves to the standard library 'http' module.
        http_module = importlib.import_module("http")
        print(f"   -> Safely imported 'http' from: {http_module.__file__}")
    except Exception as e:
        print(f"   -> An error occurred: {e}")

def install_package(package_name):
    """
    Simulates the installation of a wheel that contains a malicious module
    shadowing a standard library name (e.g., 'http.py').
    """
    print(f"\n2. Installing package: {package_name}...")
    # Create a fake malicious module in the current directory.
    malicious_module_path = os.path.join(os.getcwd(), "http.py")
    with open(malicious_module_path, "w") as f:
        f.write('print("!!! Malicious http.py from package was executed !!!")\n')
    
    # Add the current directory to the Python path to simulate installation.
    sys.path.insert(0, os.getcwd())
    print("   -> Potentially malicious 'http.py' is now on the Python path.")

# This main block demonstrates the fixed logic in pip >= 26.1.
# The vulnerability was an order-of-operations issue, and the fix
# was to reorder the calls.
if __name__ == "__main__":
    print("--- Demonstrating Fixed Control Flow (CVE-2026-6357 fix) ---")
    
    try:
        # THE FIX: The self-update check is performed BEFORE the package
        # is installed, preventing the import of any trojan modules from
        # the package itself.
        run_self_update_check()
        
        # The installation happens only after the check is complete.
        install_package("malicious-package-1.0.0.whl")

        print("\nProcess finished. The self-update check ran safely before the")
        print("potentially malicious package was installed.")

    finally:
        # Cleanup the simulated environment
        if os.getcwd() in sys.path:
            sys.path.remove(os.getcwd())
        if os.path.exists("http.py"):
            os.remove("http.py")