Skip to content

Prevent uninstalling site-packages for empty .egg-info top_level.txt#19114

Open
nooscraft wants to merge 2 commits intoastral-sh:mainfrom
nooscraft:bugfix/19113
Open

Prevent uninstalling site-packages for empty .egg-info top_level.txt#19114
nooscraft wants to merge 2 commits intoastral-sh:mainfrom
nooscraft:bugfix/19113

Conversation

@nooscraft
Copy link
Copy Markdown
Contributor

uv pip uninstall <pkg> against a legacy .egg-info distribution with an empty top_level.txt could resolve "" back to the distribution location itself and end up deleting site-packages.

In uninstall_egg crate, each line from top_level.txt is now trimmed and empty entries are skipped before iterating. Applied the same trim + non-empty handling to namespace_packages.txt so both files are parsed consistently. I did not also change is_path_in_scheme to reject paths equal to a scheme root, since that is a broader defense-in-depth change and outside the scope of this fix.

Covered by test_uninstall_egg_info_empty_top_level next to the existing test_uninstall_egg_info_path_traversal, plus test_uninstall_egg_info_blank_lines_in_top_level for blank and whitespace-only lines between valid entries, which hits the same wipe path before the fix. It fails on main with uninstall must not remove site-packages itself and passes with this fix. Existing uninstall_egg_info, dry_run_uninstall_egg_info, and uninstall_legacy_editable integration tests still pass.

Closes #19113.

Checks that uninstall ignores blank or whitespace-only lines in top_level.txt, still removes valid entries, and does not touch site-packages.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

uv pip uninstall removes whole site-packages directory when removing empty package with .egg-info metadata

1 participant