Catch an edge case in expand._assert_local()

Using str.startswith() has an edge case where someone can access files
outside the root directory. For example, consider the case where the
root directory is "/home/user/my-package" but some secrets are stored in
"/home/user/my-package-secrets". Evaluating a check that
"/home/user/my-package-secrets".startswith("/home/user/my-package") will
return True, but the statement's intention is that no file outside of
"/home/user/my-package" can be accessed.

Using pathlib.Path.resolve() and pathlib.Path.parents eliminates this
edge case.

1 files changed, 9 insertions, 0 deletions

diff --git a/setuptools/tests/config/test_expand.py b/setuptools/tests/config/test_expand.py
index 523779a8..87e00438 100644
--- a/setuptools/tests/config/test_expand.py
+++ b/setuptools/tests/config/test_expand.py
@@ -1,4 +1,5 @@
 import os
+from pathlib import Path
 
 import pytest
 
@@ -45,6 +46,10 @@ def test_read_files(tmp_path, monkeypatch):
     }
     write_files(files, dir_)
 
+    secrets = Path(str(dir_) + "secrets")
+    secrets.mkdir(exist_ok=True)
+    write_files({"secrets.txt": "secret keys"}, secrets)
+
     with monkeypatch.context() as m:
         m.chdir(dir_)
         assert expand.read_files(list(files)) == "a\nb\nc"
@@ -53,6 +58,10 @@ def test_read_files(tmp_path, monkeypatch):
         with pytest.raises(DistutilsOptionError, match=cannot_access_msg):
             expand.read_files(["../a.txt"])
 
+        cannot_access_secrets_msg = r"Cannot access '.*secrets\.txt'"
+        with pytest.raises(DistutilsOptionError, match=cannot_access_secrets_msg):
+            expand.read_files(["../dir_secrets/secrets.txt"])
+
     # Make sure the same APIs work outside cwd
     assert expand.read_files(list(files), dir_) == "a\nb\nc"
     with pytest.raises(DistutilsOptionError, match=cannot_access_msg):