Commit 91d769e8 authored by Jason R. Coombs's avatar Jason R. Coombs

Disallow Windows absolute paths unconditionally with no deprecation period.

parent 36a6a8bc
...@@ -39,6 +39,8 @@ import tempfile ...@@ -39,6 +39,8 @@ import tempfile
import textwrap import textwrap
import itertools import itertools
import inspect import inspect
import ntpath
import posixpath
from pkgutil import get_importer from pkgutil import get_importer
try: try:
...@@ -1497,15 +1499,34 @@ class NullProvider: ...@@ -1497,15 +1499,34 @@ class NullProvider:
>>> vrp('foo/f../bar.txt') >>> vrp('foo/f../bar.txt')
>>> bool(warned) >>> bool(warned)
False False
Windows path separators are straight-up disallowed.
>>> vrp(r'\\foo/bar.txt')
Traceback (most recent call last):
...
ValueError: Use of .. or absolute path in a resource path \
is not allowed.
>>> vrp(r'C:\\foo/bar.txt')
Traceback (most recent call last):
...
ValueError: Use of .. or absolute path in a resource path \
is not allowed.
""" """
invalid = ( invalid = (
'..' in path.split('/') or os.path.pardir in path.split(posixpath.sep) or
path.startswith('/') posixpath.isabs(path) or
ntpath.isabs(path)
) )
if not invalid: if not invalid:
return return
msg = "Use of .. or leading '/' in a resource path is not allowed." msg = "Use of .. or absolute path in a resource path is not allowed."
# Aggressively disallow Windows absolute paths
if ntpath.isabs(path) and not posixpath.isabs(path):
raise ValueError(msg)
# for compatibility, warn; in future # for compatibility, warn; in future
# raise ValueError(msg) # raise ValueError(msg)
warnings.warn( warnings.warn(
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment