Reject rooted Windows targets, not just is_absolute() ones.

ben-edna · ben-edna · commit 864eafcc3f46 · 2026-03-31T10:17:34.000+02:00
diff --git a/dfetch/vcs/archive.py b/dfetch/vcs/archive.py
@@ -378,7 +378,7 @@ def _is_unsafe_symlink_target(target: str) -> bool:
         win = pathlib.PureWindowsPath(target)
         return (
             posix.is_absolute()
-            or win.is_absolute()
+            or bool(win.anchor)
             or any(part == ".." for part in posix.parts)
             or any(part == ".." for part in win.parts)
         )

Original file line number	Diff line number	Diff line change
`@@ -378,7 +378,7 @@ def _is_unsafe_symlink_target(target: str) -> bool:`
`378`	`378`	`win = pathlib.PureWindowsPath(target)`
`379`	`379`	`return (`
`380`	`380`	`posix.is_absolute()`
`381`		`- or win.is_absolute()`
	`381`	`+ or bool(win.anchor)`
`382`	`382`	`or any(part == ".." for part in posix.parts)`
`383`	`383`	`or any(part == ".." for part in win.parts)`
`384`	`384`	`)`