Skip to content

Commit e66f94c

Browse files
authored
Explicitly disallow resource paths starting with single backslash (pypa#4356)
2 parents 544b332 + d53bf15 commit e66f94c

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

pkg_resources/__init__.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1604,14 +1604,15 @@ def _validate_resource_path(path):
16041604
os.path.pardir in path.split(posixpath.sep)
16051605
or posixpath.isabs(path)
16061606
or ntpath.isabs(path)
1607+
or path.startswith("\\")
16071608
)
16081609
if not invalid:
16091610
return
16101611

16111612
msg = "Use of .. or absolute path in a resource path is not allowed."
16121613

16131614
# Aggressively disallow Windows absolute paths
1614-
if ntpath.isabs(path) and not posixpath.isabs(path):
1615+
if (path.startswith("\\") or ntpath.isabs(path)) and not posixpath.isabs(path):
16151616
raise ValueError(msg)
16161617

16171618
# for compatibility, warn; in future

0 commit comments

Comments
 (0)