Thanks to visit codestin.com
Credit goes to github.com

Skip to content

MNT Raise ValueError if local_filename is not a plain filename in sklearn.datasets.fetch_file - #34815

Merged
lesteve merged 7 commits into
scikit-learn:mainfrom
DeaMariaLeon:path
Aug 27, 2026
Merged

MNT Raise ValueError if local_filename is not a plain filename in sklearn.datasets.fetch_file#34815
lesteve merged 7 commits into
scikit-learn:mainfrom
DeaMariaLeon:path

Conversation

@DeaMariaLeon

@DeaMariaLeon DeaMariaLeon commented Aug 25, 2026

Copy link
Copy Markdown
Member

Reference Issues/PRs

None

What does this implement/fix? Explain your changes.

Raise when local_file is a path.

Introduce yourself

AI usage disclosure

I used AI assistance for:

  • Code generation (e.g., when writing an implementation or fixing a bug)
  • Research and understanding

Any other comments?

@lesteve

For maintainers see https://github.com/scikit-learn/scikit-learn/security/advisories/GHSA-m2ff-mg72-q9p4 for more context.

@DeaMariaLeon
DeaMariaLeon marked this pull request as ready for review August 25, 2026 16:45
@lesteve lesteve changed the title FIX Path traversal in sklearn.datasets.fetch_file MNT Make sure local_filename is a plain filename in sklearn.datasets.fetch_file Aug 26, 2026
@lesteve

lesteve commented Aug 26, 2026

Copy link
Copy Markdown
Member

Since this is a small change in behaviour, even if I suspect this will not affect anyone, please add a changelog ("Fix" category) saying something like:

raise ValueError when local_filename is not a plain filename in sklearn.datasets.fetch_file.

@lesteve lesteve left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few comments, but LGTM otherwise.

Comment thread sklearn/datasets/tests/test_base.py
Comment thread sklearn/datasets/tests/test_base.py
Comment thread sklearn/datasets/tests/test_base.py
@DeaMariaLeon DeaMariaLeon moved this to PR waiting for reviews in Labs Aug 26, 2026
@lesteve lesteve changed the title MNT Make sure local_filename is a plain filename in sklearn.datasets.fetch_file MNT Raise ValueError if sklearn.datasets.fetch_file local_filename argument is not a plain filename Aug 26, 2026
@lesteve lesteve changed the title MNT Raise ValueError if sklearn.datasets.fetch_file local_filename argument is not a plain filename MNT Raise ValueError if local_filename is not a plain filename in sklearn.datasets.fetch_file Aug 26, 2026
Comment thread sklearn/datasets/_base.py Outdated

@lesteve lesteve left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks!

@lesteve
lesteve merged commit aab0d04 into scikit-learn:main Aug 27, 2026
37 checks passed
@github-project-automation github-project-automation Bot moved this from PR waiting for reviews to Done in Labs Aug 27, 2026
@DeaMariaLeon
DeaMariaLeon deleted the path branch August 27, 2026 15:17
@DeaMariaLeon

Copy link
Copy Markdown
Member Author

Thank you!

prady0t pushed a commit to prady0t/scikit-learn that referenced this pull request Sep 2, 2026
@jeremiedbb jeremiedbb mentioned this pull request Sep 8, 2026
14 tasks
jeremiedbb pushed a commit to jeremiedbb/scikit-learn that referenced this pull request Sep 8, 2026
jeremiedbb pushed a commit to jeremiedbb/scikit-learn that referenced this pull request Sep 8, 2026
jeremiedbb pushed a commit to jeremiedbb/scikit-learn that referenced this pull request Sep 8, 2026
jeremiedbb pushed a commit to jeremiedbb/scikit-learn that referenced this pull request Sep 9, 2026
jeremiedbb pushed a commit to jeremiedbb/scikit-learn that referenced this pull request Sep 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants