1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
From 2e9f44a74a8adbaf641475c58f1cfa1bb7ab15e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Fri, 9 Jan 2026 10:19:39 -0800
Subject: [PATCH] Merge pull request #3013 from gaborbernat/fix-sec
CVE: CVE-2026-22702
Upstream-Status: Backport [https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/virtualenv/app_data/__init__.py | 11 +++++------
src/virtualenv/util/lock.py | 7 +++----
2 files changed, 8 insertions(+), 10 deletions(-)
diff --git a/src/virtualenv/app_data/__init__.py b/src/virtualenv/app_data/__init__.py
index d7f1480..7a9d38e 100644
--- a/src/virtualenv/app_data/__init__.py
+++ b/src/virtualenv/app_data/__init__.py
@@ -36,12 +36,11 @@ def make_app_data(folder, **kwargs):
if is_read_only:
return ReadOnlyAppData(folder)
- if not os.path.isdir(folder):
- try:
- os.makedirs(folder)
- LOGGER.debug("created app data folder %s", folder)
- except OSError as exception:
- LOGGER.info("could not create app data folder %s due to %r", folder, exception)
+ try:
+ os.makedirs(folder, exist_ok=True)
+ LOGGER.debug("created app data folder %s", folder)
+ except OSError as exception:
+ LOGGER.info("could not create app data folder %s due to %r", folder, exception)
if os.access(folder, os.W_OK):
return AppDataDiskFolder(folder)
diff --git a/src/virtualenv/util/lock.py b/src/virtualenv/util/lock.py
index b250e03..82c8eed 100644
--- a/src/virtualenv/util/lock.py
+++ b/src/virtualenv/util/lock.py
@@ -17,9 +17,8 @@ LOGGER = logging.getLogger(__name__)
class _CountedFileLock(FileLock):
def __init__(self, lock_file) -> None:
parent = os.path.dirname(lock_file)
- if not os.path.isdir(parent):
- with suppress(OSError):
- os.makedirs(parent)
+ with suppress(OSError):
+ os.makedirs(parent, exist_ok=True)
super().__init__(lock_file)
self.count = 0
@@ -117,7 +116,7 @@ class ReentrantFileLock(PathLockBase):
# a lock, but that lock might then become expensive, and it's not clear where that lock should live.
# Instead here we just ignore if we fail to create the directory.
with suppress(OSError):
- os.makedirs(str(self.path))
+ os.makedirs(str(self.path), exist_ok=True)
try:
lock.acquire(0.0001)
|
