Skip to content

Commit 87cc78a

Browse files
committed
catch special absolute path on Windows Python < 3.11
1 parent 50cfeeb commit 87cc78a

File tree

3 files changed

+16
-6
lines changed

3 files changed

+16
-6
lines changed

CHANGES.rst

+3
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ Unreleased
88
- Fix how ``max_form_memory_size`` is applied when parsing large non-file
99
fields. :ghsa:`q34m-jh98-gwm2`
1010

11+
- ``safe_join`` catches certain paths on Windows that were not caught by
12+
``ntpath.isabs`` on Python < 3.11. :ghsa:`f9vj-2wh5-fj8j`
13+
1114

1215
Version 3.0.5
1316
-------------

src/werkzeug/security.py

+2
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,8 @@ def safe_join(directory: str, *pathnames: str) -> str | None:
151151
if (
152152
any(sep in filename for sep in _os_alt_seps)
153153
or os.path.isabs(filename)
154+
# ntpath.isabs doesn't catch this on Python < 3.11
155+
or filename.startswith("/")
154156
or filename == ".."
155157
or filename.startswith("../")
156158
):

tests/test_security.py

+11-6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
import os
2-
import posixpath
32
import sys
43

54
import pytest
@@ -47,11 +46,17 @@ def test_invalid_method():
4746
generate_password_hash("secret", "sha256")
4847

4948

50-
def test_safe_join():
51-
assert safe_join("foo", "bar/baz") == posixpath.join("foo", "bar/baz")
52-
assert safe_join("foo", "../bar/baz") is None
53-
if os.name == "nt":
54-
assert safe_join("foo", "foo\\bar") is None
49+
@pytest.mark.parametrize(
50+
("path", "expect"),
51+
[
52+
("b/c", "a/b/c"),
53+
("../b/c", None),
54+
("b\\c", None if os.name == "nt" else "a/b\\c"),
55+
("//b/c", None),
56+
],
57+
)
58+
def test_safe_join(path, expect):
59+
assert safe_join("a", path) == expect
5560

5661

5762
def test_safe_join_os_sep():

0 commit comments

Comments
 (0)