GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-160506: Fix ntpath.realpath() for broken links via directory links by gpshead · Pull Request #160507 · python/cpython

Conversation

gpshead commented Oct 23, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

ntpath._readlink_deep(), the fallback realpath() uses for a link Windows cannot open, now resolves the directory that contains the link with _getfinalpathname() before joining a relative target to it, so .. in the target goes up from the real directory. It keeps the textual join only if that directory cannot be resolved with one of the error codes the function already tolerates. Two expectations in test_realpath_broken_symlinks change (broken2 and broken3 now resolve to ABSTFN\missing), because they asserted the unresolved join.

I could not run this on Windows: the changed branch and the test_ntpath tests are skipped on Linux, where I only exercised the code over stand-ins for the nt functions. It needs the Windows CI run before review. test_parent_symlink3 in test_tarfile passes on Linux with and without the change; its Windows branch is the one that depends on it.

Fixes #160506

ANT-2026-27II3A20

Issue: os.path.realpath() on Windows misresolves a broken symlink reached through a directory symlink #160506

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          pythongh-160506: Fix ntpath.realpath() for broken links via directory…

5dbdc22

… links

Resolve the directory containing a broken relative symlink before
joining the link target to it, so that '..' in the target is applied
to the real directory.

ANT-2026-27II3A20

gpshead added needs backport to 3.11

only security fixes

needs backport to 3.12

only security fixes

needs backport to 3.13

only security fixes

needs backport to 3.14

bugs and security fixes

needs backport to 3.15 bugs and security fixes labels

Oct 23, 2026

gpshead self-assigned this

Oct 23, 2026

bedevere-app Bot mentioned this pull request

Oct 23, 2026

os.path.realpath() on Windows misresolves a broken symlink reached through a directory symlink #160506

Closed

gpshead added type-security

A security issue

sprint labels

Oct 23, 2026

github-project-automation Bot added this to Sprint

Oct 23, 2026

github-project-automation Bot moved this to Todo in Sprint

Oct 23, 2026

gpshead marked this pull request as ready for review

October 25, 2026 06:03

gpshead requested a review from ethanfurman as a code owner

October 25, 2026 06:03

bedevere-app Bot added the awaiting core review label

Oct 25, 2026

gpshead requested a review from zooba

October 25, 2026 06:03

gpshead moved this from Todo to In Progress in Sprint

Oct 25, 2026

gpshead commented Oct 31, 2026

Copy link

Copy Markdown

Member Author

!buildbot windows

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-bot commented Oct 31, 2026

Copy link

Copy Markdown

🤖 New build scheduled with the buildbot fleet by @gpshead for commit 5dbdc22 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F160507%2Fmerge

The command will test the builders whose names match following regular expression: windows

The builders matched are:

AMD64 Windows10 PR
AMD64 Windows PGO NoGIL Tailcall PR
ARM64 Windows Non-Debug PR
AMD64 Windows Server 2025 Clang PR
AMD64 Windows PGO NoGIL PR
ARM64 Windows PGO PR
AMD64 Windows Server 2025 Refleaks PR
ARM64 Windows PR
ARM64 Windows Refleaks PR
AMD64 Windows PGO Tailcall PR
AMD64 Windows PGO PR
AMD64 Windows11 Non-Debug PR
AMD64 Windows Server 2022 NoGIL PR

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gpshead merged commit 65665a4 into python:main

Oct 31, 2026

80 of 82 checks passed

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting core review label

Oct 31, 2026

miss-islington-app Bot commented Oct 31, 2026

Copy link

Copy Markdown

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Oct 31, 2026

gpshead added a commit that referenced this pull request

Oct 31, 2026


          [3.15] gh-160506: Fix ntpath.realpath() for broken links via director…

18e07bf

…y links (GH-160507) (#161026)

gh-160506: Fix ntpath.realpath() for broken links via directory links (GH-160507)

Resolve the directory containing a broken relative symlink before
joining the link target to it, so that '..' in the target is applied
to the real directory.

ANT-2026-27II3A20
(cherry picked from commit 65665a4)

Co-authored-by: Gregory P. Smith <[email protected]>

gpshead added a commit that referenced this pull request

Nov 9, 2026


          [3.14] gh-160506: Fix ntpath.realpath() for broken links via director…

dbcf003

…y links (GH-160507) (#161027)

gh-160506: Fix ntpath.realpath() for broken links via directory links (GH-160507)

Resolve the directory containing a broken relative symlink before
joining the link target to it, so that '..' in the target is applied
to the real directory.

ANT-2026-27II3A20
(cherry picked from commit 65665a4)

Co-authored-by: Gregory P. Smith <[email protected]>

Reviewers

ethanfurman

Awaiting requested review from ethanfurman

ethanfurman is a code owner

zooba

Awaiting requested review from zooba

Uh oh!

There was an error while loading. Please reload this page.

Assignees

gpshead

Labels

sprint type-security

A security issue

Projects

Sprint

Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

os.path.realpath() on Windows misresolves a broken symlink reached through a directory symlink

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

gpshead commented Oct 23, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gpshead commented Oct 31, 2026

Uh oh!

bedevere-bot commented Oct 31, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Oct 31, 2026

Uh oh!

bedevere-app Bot commented Oct 31, 2026

Uh oh!

bedevere-app Bot commented Oct 31, 2026

Uh oh!

bedevere-app Bot commented Oct 31, 2026

Uh oh!

bedevere-app Bot commented Oct 31, 2026

Uh oh!

bedevere-app Bot commented Oct 31, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gpshead commented Oct 23, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.