From 4249da1ecfaca9541d64f0d3c7f08fb22e73e3b9 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Sun, 18 Sep 2022 19:30:03 -0400 Subject: Catch an edge case in expand._assert_local() Using str.startswith() has an edge case where someone can access files outside the root directory. For example, consider the case where the root directory is "/home/user/my-package" but some secrets are stored in "/home/user/my-package-secrets". Evaluating a check that "/home/user/my-package-secrets".startswith("/home/user/my-package") will return True, but the statement's intention is that no file outside of "/home/user/my-package" can be accessed. Using pathlib.Path.resolve() and pathlib.Path.parents eliminates this edge case. --- setuptools/tests/config/test_expand.py | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'setuptools/tests') diff --git a/setuptools/tests/config/test_expand.py b/setuptools/tests/config/test_expand.py index 523779a8..87e00438 100644 --- a/setuptools/tests/config/test_expand.py +++ b/setuptools/tests/config/test_expand.py @@ -1,4 +1,5 @@ import os +from pathlib import Path import pytest @@ -45,6 +46,10 @@ def test_read_files(tmp_path, monkeypatch): } write_files(files, dir_) + secrets = Path(str(dir_) + "secrets") + secrets.mkdir(exist_ok=True) + write_files({"secrets.txt": "secret keys"}, secrets) + with monkeypatch.context() as m: m.chdir(dir_) assert expand.read_files(list(files)) == "a\nb\nc" @@ -53,6 +58,10 @@ def test_read_files(tmp_path, monkeypatch): with pytest.raises(DistutilsOptionError, match=cannot_access_msg): expand.read_files(["../a.txt"]) + cannot_access_secrets_msg = r"Cannot access '.*secrets\.txt'" + with pytest.raises(DistutilsOptionError, match=cannot_access_secrets_msg): + expand.read_files(["../dir_secrets/secrets.txt"]) + # Make sure the same APIs work outside cwd assert expand.read_files(list(files), dir_) == "a\nb\nc" with pytest.raises(DistutilsOptionError, match=cannot_access_msg): -- cgit v1.2.1