31 lines
905 B
Diff
31 lines
905 B
Diff
From ff1c62ede76e29a9d00bbbad266afa59ee153e51 Mon Sep 17 00:00:00 2001
|
|
From: "Jason R. Coombs" <jaraco@jaraco.com>
|
|
Date: Sat, 19 Apr 2025 13:03:47 -0400
|
|
Subject: [PATCH] Add a check to ensure the name resolves relative to the
|
|
tmpdir.
|
|
|
|
Closes #4946
|
|
|
|
---
|
|
setuptools/package_index.py | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/setuptools/package_index.py b/setuptools/package_index.py
|
|
index 1d3e5b4..79953f8 100755
|
|
--- a/setuptools/package_index.py
|
|
+++ b/setuptools/package_index.py
|
|
@@ -808,6 +808,10 @@ class PackageIndex(Environment):
|
|
|
|
filename = os.path.join(tmpdir, name)
|
|
|
|
+ # ensure path resolves within the tmpdir
|
|
+ if not filename.startswith(str(tmpdir)):
|
|
+ raise ValueError("Invalid filename {filename}".format(filename = filename))
|
|
+
|
|
# Download the file
|
|
#
|
|
if scheme == 'svn' or scheme.startswith('svn+'):
|
|
--
|
|
2.49.0
|
|
|