From 7cac095948e86d8a0e0e17de6b763727e9b051ac Mon Sep 17 00:00:00 2001 From: Damian Shaw Date: Mon, 18 May 2026 23:22:51 -0400 Subject: [PATCH] Fix is_within_directory for doubled-slash roots CVE: CVE-2026-8643 Upstream-Status: Backport [https://github.com/pypa/pip/commit/7ff8bdd81ec5edca2bebf78ad8506dda710d6af5] Backport Changes: - Omit tests/unit/test_utils_unpacking.py because the pip 24.0 PyPI sdist used by this recipe does not ship the upstream tests directory. (cherry picked from commit 7ff8bdd81ec5edca2bebf78ad8506dda710d6af5) Signed-off-by: Hetvi Thakar --- src/pip/_internal/utils/unpacking.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/pip/_internal/utils/unpacking.py b/src/pip/_internal/utils/unpacking.py index 0b26525fb..188f27e67 100644 --- a/src/pip/_internal/utils/unpacking.py +++ b/src/pip/_internal/utils/unpacking.py @@ -81,8 +81,7 @@ def is_within_directory(directory: str, target: str) -> bool: abs_directory = os.path.abspath(directory) abs_target = os.path.abspath(target) - prefix = os.path.commonpath([abs_directory, abs_target]) - return prefix == abs_directory + return abs_target == abs_directory or abs_target.startswith(abs_directory + os.sep) def set_extracted_file_to_default_mode_plus_executable(path: str) -> None: -- 2.35.6