From 4c651b70d60ed91b13663bcda9b3ed41748d0124 Mon Sep 17 00:00:00 2001 From: Seth Michael Larson Date: Fri, 30 Jan 2026 09:49:11 -0600 Subject: [PATCH] Use os.path.commonpath() instead of commonprefix() --- news/+1ee322a1.bugfix.rst | 1 + src/pip/_internal/utils/unpacking.py | 2 +- tests/unit/test_utils_unpacking.py | 2 ++ 3 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 news/+1ee322a1.bugfix.rst Index: pip-25.0.1/news/+1ee322a1.bugfix.rst =================================================================== --- /dev/null +++ pip-25.0.1/news/+1ee322a1.bugfix.rst @@ -0,0 +1 @@ +Use a path-segment prefix comparison, not char-by-char. Index: pip-25.0.1/src/pip/_internal/utils/unpacking.py =================================================================== --- pip-25.0.1.orig/src/pip/_internal/utils/unpacking.py +++ pip-25.0.1/src/pip/_internal/utils/unpacking.py @@ -82,7 +82,7 @@ def is_within_directory(directory: str, abs_directory = os.path.abspath(directory) abs_target = os.path.abspath(target) - prefix = os.path.commonprefix([abs_directory, abs_target]) + prefix = os.path.commonpath([abs_directory, abs_target]) return prefix == abs_directory Index: pip-25.0.1/tests/unit/test_utils_unpacking.py =================================================================== --- pip-25.0.1.orig/tests/unit/test_utils_unpacking.py +++ pip-25.0.1/tests/unit/test_utils_unpacking.py @@ -270,6 +270,8 @@ def test_unpack_tar_unicode(tmpdir: Path (("parent/", "parent/sub"), True), # Test target outside parent (("parent/", "parent/../sub"), False), + # Test target sub-string of parent + (("parent/child", "parent/childfoo"), False), ], ) def test_is_within_directory(args: Tuple[str, str], expected: bool) -> None: