From ff1c62ede76e29a9d00bbbad266afa59ee153e51 Mon Sep 17 00:00:00 2001 From: "Jason R. Coombs" Date: Sat, 19 Apr 2025 13:03:47 -0400 Subject: [PATCH] Add a check to ensure the name resolves relative to the tmpdir. Closes #4946 --- setuptools/package_index.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/setuptools/package_index.py b/setuptools/package_index.py index 1d3e5b4..79953f8 100755 --- a/setuptools/package_index.py +++ b/setuptools/package_index.py @@ -808,6 +808,10 @@ class PackageIndex(Environment): filename = os.path.join(tmpdir, name) + # ensure path resolves within the tmpdir + if not filename.startswith(str(tmpdir)): + raise ValueError("Invalid filename {filename}".format(filename = filename)) + # Download the file # if scheme == 'svn' or scheme.startswith('svn+'): -- 2.49.0