# PoC — arbitrary local file read when loading a NetCDF (.nc) file

A `.nc` file can make `netCDF4`/`xarray` read an arbitrary file off the machine that
opens it. NetCDF-4 is HDF5 underneath, and HDF5 lets a variable's raw data live in an
*external* file (`H5Pset_external`). libnetcdf follows that reference silently, so when
you open the file and read the variable, you get back the bytes of whatever file the
author pointed at — including absolute paths well outside the working directory.

Nothing here is malicious to run; the "secret" is a marker string I put next to the file.

## Files
- `poc_secret.nc` — variable `leak` is backed by the relative path `secret.txt` (shipped here). Works on any OS.
- `secret.txt` — the stand-in secret so PoC 1 is self-contained.
- `poc_passwd.nc` — variable `leak` is backed by the absolute path `/etc/passwd`. On a Linux box this reads the real passwd file.
- `verify.py` — opens a `.nc` and prints the `leak` variable's bytes.
- `build_poc_hf.py` — how the two `.nc` files were built (with `h5py`).

## Reproduce
```
pip install netCDF4          # or: pip install xarray netCDF4
python verify.py poc_secret.nc     # prints the contents of secret.txt
python verify.py poc_passwd.nc     # on Linux, prints /etc/passwd
```

Or with xarray:
```python
import xarray as xr
print(bytes(xr.open_dataset("poc_passwd.nc")["leak"].values.tobytes()))
```

## Why it matters
Anywhere a service ingests a user-supplied `.nc` (model weights, scientific datasets,
data-conversion pipelines) and later reads the variable — or re-saves it — the targeted
file's bytes are pulled in and can end up in the output. It's a pure default-path read;
there's no safe-mode flag in `netCDF4`/`xarray` that turns external references off.