|
| 1 | +From 7f85b4d60f6efc690baf11266650eaba0b1d6c46 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Damian Shaw <damian.peter.shaw@gmail.com> |
| 3 | +Date: Mon, 18 May 2026 23:04:43 -0400 |
| 4 | +Subject: [PATCH] Reject entry point names that escape scripts dir |
| 5 | + |
| 6 | +Upstream Patch Reference: https://patch-diff.githubusercontent.com/raw/pypa/pip/pull/14000.patch |
| 7 | +--- |
| 8 | + pip/_internal/operations/install/wheel.py | 26 ++++++++++++++++++++--- |
| 9 | + 1 file changed, 23 insertions(+), 3 deletions(-) |
| 10 | + |
| 11 | +diff --git a/pip/_internal/operations/install/wheel.py b/pip/_internal/operations/install/wheel.py |
| 12 | +index 2724f15..ec2faaa 100644 |
| 13 | +--- a/pip/_internal/operations/install/wheel.py |
| 14 | ++++ b/pip/_internal/operations/install/wheel.py |
| 15 | +@@ -397,11 +397,31 @@ class MissingCallableSuffix(InstallationError): |
| 16 | + ) |
| 17 | + |
| 18 | + |
| 19 | +-def _raise_for_invalid_entrypoint(specification: str) -> None: |
| 20 | ++def _script_within_dir(name: str, scripts_dir: str) -> bool: |
| 21 | ++ """Return whether script ``name`` resolves to a path inside the ``scripts_dir``. |
| 22 | ++ |
| 23 | ++ distlib joins the entry point name onto the scripts directory, so a name |
| 24 | ++ with path separators or ``..`` components can resolve elsewhere. |
| 25 | ++ """ |
| 26 | ++ root = os.path.normpath(scripts_dir) |
| 27 | ++ dest = os.path.normpath(os.path.join(scripts_dir, name)) |
| 28 | ++ return dest.startswith(root + os.sep) |
| 29 | ++ |
| 30 | ++ |
| 31 | ++def _raise_for_invalid_entrypoint(specification: str, scripts_dir: str) -> None: |
| 32 | + entry = get_export_entry(specification) |
| 33 | +- if entry is not None and entry.suffix is None: |
| 34 | ++ if entry is None: |
| 35 | ++ return |
| 36 | ++ |
| 37 | ++ if entry.suffix is None: |
| 38 | + raise MissingCallableSuffix(str(entry)) |
| 39 | + |
| 40 | ++ if not _script_within_dir(entry.name, scripts_dir): |
| 41 | ++ raise InstallationError( |
| 42 | ++ f"Invalid script entry point name {entry.name!r}: the script " |
| 43 | ++ f"would be installed outside the scripts directory ({scripts_dir})." |
| 44 | ++ ) |
| 45 | ++ |
| 46 | + |
| 47 | + class PipScriptMaker(ScriptMaker): |
| 48 | + # Override distlib's default script template with one that |
| 49 | +@@ -420,7 +440,7 @@ class PipScriptMaker(ScriptMaker): |
| 50 | + def make( |
| 51 | + self, specification: str, options: dict[str, Any] | None = None |
| 52 | + ) -> list[str]: |
| 53 | +- _raise_for_invalid_entrypoint(specification) |
| 54 | ++ _raise_for_invalid_entrypoint(specification, self.target_dir) |
| 55 | + return super().make(specification, options) |
| 56 | + |
| 57 | + |
| 58 | +-- |
| 59 | +2.45.4 |
| 60 | + |
0 commit comments