Patched code sample

import os

# A secure base directory where notebooks are stored.
# Using os.path.abspath ensures we have a canonical path to compare against.
NOTEBOOK_DIR = os.path.abspath("./notebooks")

# Create the directory if it doesn't exist for the example to be runnable.
if not os.path.exists(NOTEBOOK_DIR):
    os.makedirs(NOTEBOOK_DIR)

def read_notebook_fixed(notebook_name: str) -> str:
    """
    Securely reads a notebook file, preventing path traversal.

    This function represents a potential fix for the vulnerability described in
    CVE-2026-7810, where user input for a filename could be manipulated
    to access arbitrary files on the server.
    """
    if not notebook_name or ".." in notebook_name or "/" in notebook_name:
        # Basic sanitization: disallow path traversal characters and separators.
        raise ValueError("Invalid notebook name provided.")

    # Construct the full path to the requested notebook.
    # os.path.join is used, but it does not by itself prevent traversal.
    requested_path = os.path.join(NOTEBOOK_DIR, notebook_name)

    # **THE FIX:**
    # 1. Resolve the absolute, canonical path of the user's request.
    #    This collapses any '..' or other relative path components.
    #    e.g., /app/notebooks/../secret/file -> /app/secret/file
    real_path = os.path.abspath(requested_path)

    # 2. Check if the resolved path is still within the intended NOTEBOOK_DIR.
    #    os.path.commonpath is a reliable way to verify this containment.
    #    If the common path of the secure base and the user's path is not
    #    the secure base itself, it's a traversal attempt.
    if os.path.commonpath([real_path, NOTEBOOK_DIR]) != NOTEBOOK_DIR:
        raise PermissionError("Path traversal attempt detected.")

    # 3. After validation, proceed with the file operation.
    if not os.path.isfile(real_path):
        raise FileNotFoundError("Notebook not found.")

    with open(real_path, 'r', encoding='utf-8') as f:
        return f.read()

# Example usage (would typically be called from a web server handler):
if __name__ == '__main__':
    # Create a safe file to demonstrate a successful read
    with open(os.path.join(NOTEBOOK_DIR, "my_notebook.txt"), "w") as f:
        f.write("This is a safe notebook.")

    # --- Test Cases ---

    # 1. Legitimate access (should succeed)
    try:
        content = read_notebook_fixed("my_notebook.txt")
        print(f"Successfully read safe file:\n---\n{content}\n---\n")
    except (ValueError, PermissionError, FileNotFoundError) as e:
        print(f"Failed to read safe file: {e}\n")

    # 2. Path Traversal attempt (should fail)
    # This tries to access a file outside the NOTEBOOK_DIR.
    malicious_input = "../../../../../etc/passwd"
    try:
        read_notebook_fixed(malicious_input)
    except (ValueError, PermissionError, FileNotFoundError) as e:
        print(f"Correctly blocked malicious input '{malicious_input}': {e}")