setuptools PackageIndex.download path traversal leading to arbitrary file write

#!/usr/bin/env python3
"""Check for CVE-2025-47273: setuptools PackageIndex path traversal.
Outputs VULNERABLE, PATCHED, or UNKNOWN.
Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
"""
import sys

try:
    import importlib.metadata as md
except ImportError:
    import importlib_metadata as md  # Python < 3.8 fallback

try:
    from packaging.version import Version
except ImportError:
    print("UNKNOWN - 'packaging' module not installed; cannot compare versions")
    sys.exit(2)

try:
    ver_str = md.version("setuptools")
except md.PackageNotFoundError:
    print("PATCHED - setuptools is not installed in this environment")
    sys.exit(0)

ver = Version(ver_str)

# Check if the vulnerable module still exists
module_removed = False
try:
    import setuptools.package_index  # noqa: F401
except (ImportError, ModuleNotFoundError):
    module_removed = True

if module_removed:
    print(f"PATCHED - setuptools {ver_str} does not contain package_index module (removed in 80.3.0)")
    sys.exit(0)

# Fixed upstream in 78.1.1; backport in 75.3.4
if ver >= Version("78.1.1"):
    print(f"PATCHED - setuptools {ver_str} >= 78.1.1 (upstream fix)")
    sys.exit(0)
elif ver >= Version("75.3.4") and ver < Version("76.0.0"):
    print(f"PATCHED - setuptools {ver_str} (75.3.x backport branch)")
    sys.exit(0)
else:
    # Check for distro backports by testing the actual behavior
    import os
    import tempfile
    try:
        from setuptools.package_index import PackageIndex
        pi = PackageIndex()
        # Test the _download_filename resolution without network
        # The fix ensures name is resolved relative to tmpdir
        with tempfile.TemporaryDirectory() as tmpdir:
            name = "/etc/test_traversal"
            result = os.path.join(tmpdir, name)
            if result == "/etc/test_traversal":
                # os.path.join still vulnerable at the language level;
                # check if setuptools added its own guard
                import inspect
                src = inspect.getsource(pi._download_url)
                if "resolve" in src or "relpath" in src or "commonpath" in src:
                    print(f"PATCHED - setuptools {ver_str} appears to have distro backport (path validation found in source)")
                    sys.exit(0)
                else:
                    print(f"VULNERABLE - setuptools {ver_str} < 78.1.1 with package_index module present")
                    sys.exit(1)
    except Exception as e:
        print(f"VULNERABLE - setuptools {ver_str} < 78.1.1 (could not confirm backport: {e})")
        sys.exit(1)

print(f"UNKNOWN - setuptools {ver_str}, unable to determine patch status")
sys.exit(2)