Sep 1, 2024 · Aug 31, 2024
diff --git a/semantic_release/cli/config.py b/semantic_release/cli/config.py
        )

        # changelog_file
        changelog_file = Path(raw.changelog.changelog_file).expanduser().resolve()
        # Must use absolute after resolve because windows does not resolve if the path does not exist
        # which means it returns a relative path. So we force absolute to ensure path is complete
        # for the next check of path matching
        changelog_file = (
            Path(raw.changelog.changelog_file).expanduser().resolve().absolute()
        )

        # Prevent path traversal attacks
        if raw.repo_dir not in changelog_file.parents:
            raise InvalidConfiguration(
                "Changelog file destination must be inside of the repository directory."
            )

        template_dir = Path(raw.changelog.template_dir).expanduser().resolve()
        # Must use absolute after resolve because windows does not resolve if the path does not exist
        # which means it returns a relative path. So we force absolute to ensure path is complete
        # for the next check of path matching
        template_dir = (
            Path(raw.changelog.template_dir).expanduser().resolve().absolute()
        )

        # Prevent path traversal attacks
        if raw.repo_dir not in template_dir.parents:
Original file line number	Diff line number	Diff line change
Expand Up		@@ -568,15 +568,25 @@ def from_raw_config( # noqa: C901
		)

		# changelog_file
		changelog_file = Path(raw.changelog.changelog_file).expanduser().resolve()
		# Must use absolute after resolve because windows does not resolve if the path does not exist
		# which means it returns a relative path. So we force absolute to ensure path is complete
		# for the next check of path matching
		changelog_file = (
		Path(raw.changelog.changelog_file).expanduser().resolve().absolute()
		)

		# Prevent path traversal attacks
		if raw.repo_dir not in changelog_file.parents:
		raise InvalidConfiguration(
		"Changelog file destination must be inside of the repository directory."
		)

		template_dir = Path(raw.changelog.template_dir).expanduser().resolve()
		# Must use absolute after resolve because windows does not resolve if the path does not exist
		# which means it returns a relative path. So we force absolute to ensure path is complete
		# for the next check of path matching
		template_dir = (
		Path(raw.changelog.template_dir).expanduser().resolve().absolute()
		)

		# Prevent path traversal attacks
		if raw.repo_dir not in template_dir.parents:
Expand Down