Thanks to visit codestin.com
Credit goes to github.com

Skip to content

gh-118441: Limit posixpath.realpath(..., strict=True) symlinks #119172

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 13 commits into from
Closed

gh-118441: Limit posixpath.realpath(..., strict=True) symlinks #119172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
3a22d93
Limit `posixpath.realpath(..., strict=True)` symlinks
nineteendo May 19, 2024
dc6f7d3
Add test
nineteendo May 19, 2024
2605bfc
📜🤖 Added by blurb_it.
blurb-it[bot] May 19, 2024
d9475bf
Fix syntax error
nineteendo May 19, 2024
b18e5d4
import `errno`
nineteendo May 19, 2024
628acd3
Use `len(seen)`
nineteendo May 19, 2024
4c60431
Merge branch 'main' into limit-posixpath.realpath-symlinks
nineteendo Jun 5, 2024
3ada546
Restrict `maxlinks` when strict is set
nineteendo Jun 5, 2024
e502666
Simplify test
nineteendo Jun 5, 2024
06c3853
Fix error message
nineteendo Jun 5, 2024
c3c0979
Rename 2024-05-19-10-12-58.gh-issue-118441.QpzMKV.rst to 2024-05-19-1…
nineteendo Jun 19, 2024
f34484e
Update 2024-05-19-10-12-58.gh-issue-118441.QpzMKV.rst
nineteendo Jun 21, 2024
dff6700
Add private constant
nineteendo Sep 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions Lib/posixpath.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -388,6 +388,8 @@ def abspath(path):
# Return a canonical path (i.e. the absolute location of a file on the
# filesystem).

_MAXLINKS = 40 # TODO: use limit set by OS

def realpath(filename, *, strict=False):
"""Return the canonical path of the specified filename, eliminating any
symbolic links encountered in the path."""
Expand All @@ -402,7 +404,8 @@ def realpath(filename, *, strict=False):
curdir = '.'
pardir = '..'
getcwd = os.getcwd
return _realpath(filename, strict, sep, curdir, pardir, getcwd)
return _realpath(filename, strict, sep, curdir, pardir, getcwd,
maxlinks=_MAXLINKS if strict else None)

def _realpath(filename, strict=False, sep=sep, curdir=curdir, pardir=pardir,
getcwd=os.getcwd, lstat=os.lstat, readlink=os.readlink, maxlinks=None):
Expand Down Expand Up @@ -453,7 +456,7 @@ def _realpath(filename, strict=False, sep=sep, curdir=curdir, pardir=pardir,
if link_count > maxlinks:
if strict:
raise OSError(errno.ELOOP, os.strerror(errno.ELOOP),
newpath)
filename)
path = newpath
continue
elif newpath in seen:
Expand All @@ -465,7 +468,7 @@ def _realpath(filename, strict=False, sep=sep, curdir=curdir, pardir=pardir,
# The symlink is not resolved, so we must have a symlink loop.
if strict:
raise OSError(errno.ELOOP, os.strerror(errno.ELOOP),
newpath)
filename)
path = newpath
continue
target = readlink(newpath)
Expand Down
27 changes: 26 additions & 1 deletion Lib/test/test_posixpath.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
import posixpath
import sys
import unittest
from posixpath import realpath, abspath, dirname, basename
from posixpath import _MAXLINKS, realpath, abspath, dirname, basename
from test import test_genericpath
from test.support import import_helper
from test.support import cpython_only, os_helper
Expand Down Expand Up @@ -689,6 +689,31 @@ def test_realpath_unreadable_symlink(self):
os.chmod(ABSTFN, 0o755, follow_symlinks=False)
os.unlink(ABSTFN)

@os_helper.skip_unless_symlink
@skip_if_ABSTFN_contains_backslash
def test_realpath_too_many_symlinks(self):
try:
os.mkdir(ABSTFN)
os.symlink('.', f'{ABSTFN}/link')
self.assertEqual(realpath(ABSTFN + '/link' * _MAXLINKS), ABSTFN)
self.assertEqual(realpath(ABSTFN + '/link' * _MAXLINKS,
strict=True), ABSTFN)
self.assertEqual(realpath(ABSTFN + '/link' * (_MAXLINKS+1)), ABSTFN)
with self.assertRaises(OSError):
realpath(ABSTFN + '/link' * (_MAXLINKS+1), strict=True)

# Test using relative path as well.
with os_helper.change_cwd(ABSTFN):
self.assertEqual(realpath('link/' * _MAXLINKS), ABSTFN)
self.assertEqual(realpath('link/' * _MAXLINKS, strict=True),
ABSTFN)
self.assertEqual(realpath('link/' * (_MAXLINKS+1)), ABSTFN)
with self.assertRaises(OSError):
realpath('link/' * (_MAXLINKS+1), strict=True)
finally:
os_helper.unlink(f'{ABSTFN}/link')
safe_rmdir(ABSTFN)

def test_relpath(self):
(real_getcwd, os.getcwd) = (os.getcwd, lambda: r"/home/user/bar")
try:
Expand Down
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Library/2024-05-19-10-12-58.gh-issue-118441.QpzMKV.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Fix error message for :func:`os.path.realpath` on Unix.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we remove this from the news entry?

:func:`os.path.realpath` now raises :exc:`OSError` when *strict* mode is enabled and a path with too many symlinks is supplied.
Loading