forked from pool/python-pip
Daniel Garcia Moreno
fa2b2a55e3
Add CVE-2026-1703.patch upstream patch (bsc#1257599, CVE-2026-1703, gh#pypa/pip#13777)
45 lines
1.8 KiB
Diff
45 lines
1.8 KiB
Diff
From 4c651b70d60ed91b13663bcda9b3ed41748d0124 Mon Sep 17 00:00:00 2001
|
|
From: Seth Michael Larson <seth@python.org>
|
|
Date: Fri, 30 Jan 2026 09:49:11 -0600
|
|
Subject: [PATCH] Use os.path.commonpath() instead of commonprefix()
|
|
|
|
---
|
|
news/+1ee322a1.bugfix.rst | 1 +
|
|
src/pip/_internal/utils/unpacking.py | 2 +-
|
|
tests/unit/test_utils_unpacking.py | 2 ++
|
|
3 files changed, 4 insertions(+), 1 deletion(-)
|
|
create mode 100644 news/+1ee322a1.bugfix.rst
|
|
|
|
Index: pip-25.0.1/news/+1ee322a1.bugfix.rst
|
|
===================================================================
|
|
--- /dev/null
|
|
+++ pip-25.0.1/news/+1ee322a1.bugfix.rst
|
|
@@ -0,0 +1 @@
|
|
+Use a path-segment prefix comparison, not char-by-char.
|
|
Index: pip-25.0.1/src/pip/_internal/utils/unpacking.py
|
|
===================================================================
|
|
--- pip-25.0.1.orig/src/pip/_internal/utils/unpacking.py
|
|
+++ pip-25.0.1/src/pip/_internal/utils/unpacking.py
|
|
@@ -82,7 +82,7 @@ def is_within_directory(directory: str,
|
|
abs_directory = os.path.abspath(directory)
|
|
abs_target = os.path.abspath(target)
|
|
|
|
- prefix = os.path.commonprefix([abs_directory, abs_target])
|
|
+ prefix = os.path.commonpath([abs_directory, abs_target])
|
|
return prefix == abs_directory
|
|
|
|
|
|
Index: pip-25.0.1/tests/unit/test_utils_unpacking.py
|
|
===================================================================
|
|
--- pip-25.0.1.orig/tests/unit/test_utils_unpacking.py
|
|
+++ pip-25.0.1/tests/unit/test_utils_unpacking.py
|
|
@@ -270,6 +270,8 @@ def test_unpack_tar_unicode(tmpdir: Path
|
|
(("parent/", "parent/sub"), True),
|
|
# Test target outside parent
|
|
(("parent/", "parent/../sub"), False),
|
|
+ # Test target sub-string of parent
|
|
+ (("parent/child", "parent/childfoo"), False),
|
|
],
|
|
)
|
|
def test_is_within_directory(args: Tuple[str, str], expected: bool) -> None:
|