GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.14] gh-160506: Fix ntpath.realpath() for broken links via directory links (GH-160507) by miss-islington · Pull Request #161027 · python/cpython

Conversation

@miss-islington

@miss-islington miss-islington commented Oct 31, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Resolve the directory containing a broken relative symlink before
joining the link target to it, so that '..' in the target is applied
to the real directory.

ANT-2026-27II3A20
(cherry picked from commit 65665a4)

Co-authored-by: Gregory P. Smith [email protected]

  • Issue: os.path.realpath() on Windows misresolves a broken symlink reached through a directory symlink #160506

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@gpshead @miss-islington
pythongh-160506: Fix ntpath.realpath() for broken links via directory…
178ba5b 
… links (pythonGH-160507)

Resolve the directory containing a broken relative symlink before
joining the link target to it, so that '..' in the target is applied
to the real directory.

ANT-2026-27II3A20
(cherry picked from commit 65665a4)

Co-authored-by: Gregory P. Smith <[email protected]>
@miss-islington
miss-islington requested a review from ethanfurman as a code owner October 31, 2026 19:09
@bedevere-app bedevere-app Bot added the awaiting review label Oct 31, 2026
This was referenced Oct 31, 2026
os.path.realpath() on Windows misresolves a broken symlink reached through a directory symlink #160506
Closed
gh-160506: Fix ntpath.realpath() for broken links via directory links #160507
Merged
@bedevere-app bedevere-app Bot added sprint type-security A security issue labels Oct 31, 2026
@github-project-automation github-project-automation Bot added this to Sprint Oct 31, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Sprint Oct 31, 2026
@gpshead
gpshead enabled auto-merge (squash) October 31, 2026 19:11
@hugovk

hugovk commented Nov 1, 2026

Copy link
Copy Markdown
Member 
  File "/Users/runner/work/cpython/cpython/Lib/test/test_ntpath.py", line 555, in TestNtpath
    @_parameterize({}, {'strict': ALL_BUT_LAST}, {'strict': ALLOW_MISSING})
                                  ^^^^^^^^^^^^
NameError: name 'ALL_BUT_LAST' is not defined

@gpshead ALL_BUT_LAST was added in #117562 and not backported.
gpshead reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead gpshead self-assigned this Nov 1, 2026
gpshead added 3 commits November 9, 2026 00:18
@gpshead
Drop ALL_BUT_LAST from the backported test; it does not exist in 3.14
7a5e934
@gpshead
Expect an OSError from test_parent_symlink3 fully_trusted on Windows
ebcf30f 
Before 3.15, tarfile keeps the '/' in symlink targets on Windows
(pythongh-57911), so writing through the '../evil' link fails, as already
handled in test_parent_symlink2.
@gpshead
Skip test_parent_symlink3 on Windows
280b30f 
Before 3.15, tarfile keeps the '/' in symlink targets on Windows
(pythongh-57911), so the links it creates cannot be followed and realpath()
fails on them.  test_ntpath covers the fix on Windows.
@gpshead
gpshead merged commit dbcf003 into python:3.14 Nov 9, 2026
49 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@github-project-automation github-project-automation Bot moved this from Todo to Done in Sprint Nov 9, 2026
@bedevere-app bedevere-app Bot removed the awaiting review label Nov 9, 2026
@miss-islington
miss-islington deleted the backport-65665a4-3.14 branch November 9, 2026 03:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

sprint type-security A security issue

Projects

Sprint
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@miss-islington @hugovk @gpshead
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.