Skip to content

gh-160506: Fix ntpath.realpath() for broken links via directory links - #160507

Open
gpshead wants to merge 1 commit into
python:mainfrom
gpshead:scanfix-ntpath-27ii3a20
Open

gpshead wants to merge 1 commit into
python:mainfrom
gpshead:scanfix-ntpath-27ii3a20

Conversation

@gpshead

@gpshead gpshead commented Oct 23, 2026 •

Copy link
Copy Markdown
Member

ntpath._readlink_deep(), the fallback realpath() uses for a link Windows cannot open, now resolves the directory that contains the link with _getfinalpathname() before joining a relative target to it, so .. in the target goes up from the real directory. It keeps the textual join only if that directory cannot be resolved with one of the error codes the function already tolerates. Two expectations in test_realpath_broken_symlinks change (broken2 and broken3 now resolve to ABSTFN\missing), because they asserted the unresolved join.

I could not run this on Windows: the changed branch and the test_ntpath tests are skipped on Linux, where I only exercised the code over stand-ins for the nt functions. It needs the Windows CI run before review. test_parent_symlink3 in test_tarfile passes on Linux with and without the change; its Windows branch is the one that depends on it.

Fixes #160506

ANT-2026-27II3A20

… links

Resolve the directory containing a broken relative symlink before
joining the link target to it, so that '..' in the target is applied
to the real directory.

ANT-2026-27II3A20
@gpshead gpshead added needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Oct 23, 2026
@gpshead gpshead self-assigned this Oct 23, 2026
@gpshead gpshead added type-security A security issue sprint labels Oct 23, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Sprint Oct 23, 2026
@gpshead
gpshead marked this pull request as ready for review October 25, 2026 06:03
@gpshead
gpshead requested a review from ethanfurman as a code owner October 25, 2026 06:03
@gpshead
gpshead requested a review from zooba October 25, 2026 06:03
@gpshead gpshead moved this from Todo to In Progress in Sprint Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

awaiting core review needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes sprint type-security A security issue

Projects

Status: In Progress

Development

Successfully merging this pull request may close these issues.

os.path.realpath() on Windows misresolves a broken symlink reached through a directory symlink

1 participant