Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

os.path.normpath truncates input on null bytes in 3.11, but not 3.10 #106242

Closed
Labels
3.11only security fixes3.12only security fixes3.13bugs and security fixesextension-modulesC modules in the Modules dirstdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue
@chrisjbillington

Description

@chrisjbillington

Bug report

Looks likeposix._path_normpath has slightly different behaviour to the python implementation ofnormpath defined inposixpath, as suchos.path.normpath behaves differently on Python 3.11 (whereposix._path_normpath is used if it exists) vs 3.10 on posix systems:

Python 3.10:

>>>importos.path>>>os.path.normpath('hello\x00world')'hello\x00world'>>>os.path.normpath('\x00hello')'\x00hello'

Python 3.11:

>>>importos.path>>>os.path.normpath('hello\x00world')'hello'>>>os.path.normpath('\x00hello')'.'

Obviously filepaths shouldn't have nulls in them, but the above means invalid input to a program could result in the wrong files or directories being used, rather than an error about embedded nulls once the filepaths are actually used for a system call. And I'm guessing the inconsistency between Python3.10 and 3.11, or between the Python and C implementations ofnormpath was not intended in any case.

Your environment

CPython 3.11.3, running on Arch Linux

Python 3.11.3 (main, Jun 5 2023, 09:32:32) [GCC 13.1.1 20230429] on linux

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.11only security fixes3.12only security fixes3.13bugs and security fixesextension-modulesC modules in the Modules dirstdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp