os.path.normpath of relative path r".\C:\x" returns absolute path r"C:\x" on Windows, similar in pathlib

os.path.normpath normalizes "./" or "../" path elements to clean the path.

As os.path.normpath doesn't consider a case where the normalized path starts with a drive letter, a relative path with a drive letter-like path element will be normalized to an absolute path. This behavior can result in a path traversal, depending on the implementation.

The minimal snippet to reproduce this behavior is the following:

> os.path.normpath("./C:/Windows/System32")

This snippet will return "C:\Windows\System32", which is an absolute path on Windows. (tested with Python 3.11.1 on Windows)

This vulnerability is similar to CVE-2022-29804 of Go.

as reported to security@ by RyotaK on 2022-12-09.

Golang solved their issue in https://github.com/golang/go/issues/52476 which may be helpful to look at.

The Python Security Response Team agreed that this issue did not require an embargo.

It looks like pathlib probably also has issues in this area:

>>> p1 = pathlib.PureWindowsPath('P:\\windows')
>>> p2 = pathlib.PureWindowsPath('.\\P:\\windows')
>>> p1 == p2
False
>>> p1
PureWindowsPath('P:/windows')
>>> p2
PureWindowsPath('P:/windows')
>>> p1.is_absolute()
True
>>> p2.is_absolute()
False
>>> str(p1) == str(p2)
True

Windows の再現で示されている os.path.normpath の動作から始め、関連する pathlib.PureWindowsPath の例を調べます。ドライブ文字のような要素を含む相対パスがどのように分類および正規化されるかを比較し、スニペットを使って、相対パスが相対のまま維持され、絶対パスが既存の動作を維持することを確認します。