From 19d6fa7fcb22aef8192dcbc0adb920c12cb6a648 Mon Sep 17 00:00:00 2001 From: "Jason R. Coombs" Date: Sat, 19 Apr 2025 13:03:47 -0400 Subject: [PATCH] Add a check to ensure the name resolves relative to the tmpdir. Closes #4946 --- setuptools/package_index.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/setuptools/package_index.py b/setuptools/package_index.py index f52592a..ebafe9f 100644 --- a/setuptools/package_index.py +++ b/setuptools/package_index.py @@ -828,6 +828,10 @@ class PackageIndex(Environment): filename = os.path.join(tmpdir, name) + # ensure path resolves within the tmpdir + if not filename.startswith(str(tmpdir)): + raise ValueError(f"Invalid filename {filename}") + # Download the file # if scheme == 'svn' or scheme.startswith('svn+'): -- 2.49.0