From d53bf1509f40c8e84feb62ac13e91b76074a063a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 14 May 2024 16:19:02 +0200 Subject: [PATCH] Explicitly disallow resource paths starting with single backslash Previously, such paths were disallowed implicitly as they were treated as Windows absolute paths. Since Python 3.13, paths starting with a single backslash are not considered Windows-absolute, so we treat them specially. This change makes the existing doctest pass with Python 3.13. Partially fixes https://github.com/pypa/setuptools/issues/4196 --- pkg_resources/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg_resources/__init__.py b/pkg_resources/__init__.py index 713d9bdfa3..faee7dec79 100644 --- a/pkg_resources/__init__.py +++ b/pkg_resources/__init__.py @@ -1604,6 +1604,7 @@ def _validate_resource_path(path): os.path.pardir in path.split(posixpath.sep) or posixpath.isabs(path) or ntpath.isabs(path) + or path.startswith("\\") ) if not invalid: return @@ -1611,7 +1612,7 @@ def _validate_resource_path(path): msg = "Use of .. or absolute path in a resource path is not allowed." # Aggressively disallow Windows absolute paths - if ntpath.isabs(path) and not posixpath.isabs(path): + if (path.startswith("\\") or ntpath.isabs(path)) and not posixpath.isabs(path): raise ValueError(msg) # for compatibility, warn; in future