blob: 1470b7c541f67b683a08dfdba327846b16a6b6b6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
From 4c651b70d60ed91b13663bcda9b3ed41748d0124 Mon Sep 17 00:00:00 2001
From: Seth Michael Larson <seth@python.org>
Date: Fri, 30 Jan 2026 09:49:11 -0600
Subject: [PATCH] Use os.path.commonpath() instead of commonprefix()
Upstream-Status: Backport [https://github.com/pypa/pip/commit/4c651b70d60ed91b13663bcda9b3ed41748d0124]
CVE: CVE-2026-1703
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
news/+1ee322a1.bugfix.rst | 1 +
src/pip/_internal/utils/unpacking.py | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
create mode 100644 news/+1ee322a1.bugfix.rst
diff --git a/news/+1ee322a1.bugfix.rst b/news/+1ee322a1.bugfix.rst
new file mode 100644
index 0000000..edb1b32
--- /dev/null
+++ b/news/+1ee322a1.bugfix.rst
@@ -0,0 +1 @@
+Use a path-segment prefix comparison, not char-by-char.
diff --git a/src/pip/_internal/utils/unpacking.py b/src/pip/_internal/utils/unpacking.py
index 78b5c13..0b26525 100644
--- a/src/pip/_internal/utils/unpacking.py
+++ b/src/pip/_internal/utils/unpacking.py
@@ -81,7 +81,7 @@ def is_within_directory(directory: str, target: str) -> bool:
abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)
- prefix = os.path.commonprefix([abs_directory, abs_target])
+ prefix = os.path.commonpath([abs_directory, abs_target])
return prefix == abs_directory
--
2.43.0
|
