bpo-9949: Enable symlink traversal for ntpath.realpath#15287
bpo-9949: Enable symlink traversal for ntpath.realpath#15287zooba merged 12 commits intopython:masterfrom
Conversation
|
This is ready to merge once CI passes. I'll do it and then rebase #15231 before merging that one. |
|
Thanks @zooba for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8. |
(cherry picked from commit 75e0649) Co-authored-by: Steve Dower <[email protected]>
|
GH-15367 is a backport of this pull request to the 3.8 branch. |
|
|
(cherry picked from commit 75e0649) Co-authored-by: Steve Dower <[email protected]>
|
|
|
| while normcase(path) not in seen: | ||
| seen.add(normcase(path)) | ||
| try: | ||
| path = _nt_readlink(path) |
There was a problem hiding this comment.
If you're allowing reading junction targets, you must fail a remote path here if path is a junction, per os.lstat. A junction target in a UNC path is meaningless to us. A junction has to target local devices on a system, i.e. its local DOS drive and volume GUID names. At best these aren't defined for us, and at worst they map to an unrelated drive on our side. If for some reason junction "spam" fails to resolve on the server, we cannot go any further. We leave it as "spam" in the UNC path, and we're done.
There was a problem hiding this comment.
If path is a relative symlink, it must be evaluated relative to its parent directory, not out current directory.
https://bugs.python.org/issue9949