27 lines
962 B
Diff
27 lines
962 B
Diff
From 250a6d17978f9f6ac3ac887091f2d32886fbbb0b Mon Sep 17 00:00:00 2001
|
|
From: "Jason R. Coombs" <jaraco@jaraco.com>
|
|
Date: Sat, 19 Apr 2025 13:03:47 -0400
|
|
Subject: [PATCH] Add a check to ensure the name resolves relative to the
|
|
tmpdir.
|
|
|
|
Closes #4946
|
|
---
|
|
setuptools/package_index.py | 18 ++++++++++++++++--
|
|
1 file changed, 16 insertions(+), 2 deletions(-)
|
|
|
|
Index: setuptools-69.0.2/setuptools/package_index.py
|
|
===================================================================
|
|
--- setuptools-69.0.2.orig/setuptools/package_index.py
|
|
+++ setuptools-69.0.2/setuptools/package_index.py
|
|
@@ -828,6 +828,10 @@ class PackageIndex(Environment):
|
|
|
|
filename = os.path.join(tmpdir, name)
|
|
|
|
+ # ensure path resolves within the tmpdir
|
|
+ if not filename.startswith(str(tmpdir)):
|
|
+ raise ValueError(f"Invalid filename {filename}")
|
|
+
|
|
return self._download_vcs(url, filename) or self._download_other(url, filename)
|
|
|
|
@staticmethod
|