Merge pull request #13777 from sethmlarson/commonpath

Use os.path.commonpath() instead of commonprefix()

Author: notatallshaw

news/+1ee322a1.bugfix.rst

@@ -0,0 +1 @@
+Use a path-segment prefix comparison, not char-by-char.

src/pip/_internal/utils/unpacking.py

@@ -83,7 +83,7 @@ def is_within_directory(directory: str, target: str) -> bool:
     abs_directory = os.path.abspath(directory)
     abs_target = os.path.abspath(target)
 
-    prefix = os.path.commonprefix([abs_directory, abs_target])
+    prefix = os.path.commonpath([abs_directory, abs_target])
     return prefix == abs_directory
 
 

tests/unit/test_utils_unpacking.py

@@ -412,6 +412,8 @@ def test_unpack_tar_unicode(tmpdir: Path) -> None:
         (("parent/", "parent/sub"), True),
         # Test target outside parent
         (("parent/", "parent/../sub"), False),
+        # Test target sub-string of parent
+        (("parent/child", "parent/childfoo"), False),
     ],
 )
 def test_is_within_directory(args: tuple[str, str], expected: bool) -> None: