[ python-Bugs-990669 ] os.path.realpath() does not handle symlinks correctly

[SourceForge.net]

Bugs item #990669, was opened at 2004-07-14 06:58
Message generated for change (Comment added) made by jlgijsbers
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=990669&group_id=5470

Category: Python Library
Group: Python 2.3
>Status: Closed
>Resolution: Fixed
Priority: 5
Submitted By: Anton Koinov (dave0000)
>Assigned to: Johannes Gijsbers (jlgijsbers)
Summary: os.path.realpath() does not handle symlinks correctly

Initial Comment:
os.path.realpath() does not handle symlinks properly on
Linux (at least, does not do it the same way as the
Linux file functions do).

To reproduce follow these steps:

mkdir a
mkdir a/k
mkdir a/l
mkdir a/k/x
mkdir a/k/y
cd a
ln -s k/y link-y
ls link-y/..

This outputs: x/  y/
In other words, link-y/.. == a/k

Now, while still in directory 'a' (in bash) execute on
one line: 
python -c 'import os.path'$'\n''print
os.path.realpath("link-y/..")'

This will print: /path/to/a
In other words: os.path.realpath('link-y/..') == a

That is, the link link-y has not been expanded to the
directory it points to before .. (go to parent
directory) has been applied to the path.

os.path.normpath() has the same problem.

This may be a potential security risk if one uses
realpath to check if a requested path is inside a
certain restricted subdirectory.

----------------------------------------------------------------------

>Comment By: Johannes Gijsbers (jlgijsbers)
Date: 2004-08-14 17:04

Message:
Logged In: YES 
user_id=469548

The patches below have been checked in. Closing as fixed.

----------------------------------------------------------------------

Comment By: Johannes Gijsbers (jlgijsbers)
Date: 2004-07-23 17:45

Message:
Logged In: YES 
user_id=469548

I've created a patch for realpath
(http://python.org/sf/996627) and a doc patch for normpath
(http://python.org/sf/996626). There's a comment in
posixpath.py warning for this problem with normpath, and
it's been there since 1992, so I don't think we should go
around changing it now.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=990669&group_id=5470