Skip to content

gh-160506: Fix ntpath.realpath() for broken links via directory links - #160507

Draft
gpshead wants to merge 1 commit into
python:mainfrom
gpshead:scanfix-ntpath-27ii3a20
Draft

gpshead wants to merge 1 commit into
python:mainfrom
gpshead:scanfix-ntpath-27ii3a20

Conversation

@gpshead

@gpshead gpshead commented Oct 23, 2026 •

Copy link
Copy Markdown
Member

ntpath._readlink_deep(), the fallback realpath() uses for a link Windows cannot open, now resolves the directory that contains the link with _getfinalpathname() before joining a relative target to it, so .. in the target goes up from the real directory. It keeps the textual join only if that directory cannot be resolved with one of the error codes the function already tolerates. Two expectations in test_realpath_broken_symlinks change (broken2 and broken3 now resolve to ABSTFN\missing), because they asserted the unresolved join.

I could not run this on Windows: the changed branch and the test_ntpath tests are skipped on Linux, where I only exercised the code over stand-ins for the nt functions. It needs the Windows CI run before review. test_parent_symlink3 in test_tarfile passes on Linux with and without the change; its Windows branch is the one that depends on it.

Fixes #160506

ANT-2026-27II3A20

… links

Resolve the directory containing a broken relative symlink before
joining the link target to it, so that '..' in the target is applied
to the real directory.

ANT-2026-27II3A20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes sprint type-security A security issue

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

os.path.realpath() on Windows misresolves a broken symlink reached through a directory symlink

1 participant