os.path.normpath of relative path r".\C:\x" returns absolute path r"C:\x" on Windows, similar in pathlib

os.path.normpath normalizes "./" or "../" path elements to clean the path.

As os.path.normpath doesn't consider a case where the normalized path starts with a drive letter, a relative path with a drive letter-like path element will be normalized to an absolute path. This behavior can result in a path traversal, depending on the implementation.

The minimal snippet to reproduce this behavior is the following:

> os.path.normpath("./C:/Windows/System32")

This snippet will return "C:\Windows\System32", which is an absolute path on Windows. (tested with Python 3.11.1 on Windows)

This vulnerability is similar to CVE-2022-29804 of Go.

as reported to security@ by RyotaK on 2022-12-09.

Golang solved their issue in https://github.com/golang/go/issues/52476 which may be helpful to look at.

The Python Security Response Team agreed that this issue did not require an embargo.

It looks like pathlib probably also has issues in this area:

>>> p1 = pathlib.PureWindowsPath('P:\\windows')
>>> p2 = pathlib.PureWindowsPath('.\\P:\\windows')
>>> p1 == p2
False
>>> p1
PureWindowsPath('P:/windows')
>>> p2
PureWindowsPath('P:/windows')
>>> p1.is_absolute()
True
>>> p2.is_absolute()
False
>>> str(p1) == str(p2)
True

Comece pelo comportamento de os.path.normpath mostrado na reprodução no Windows e, em seguida, inspecione os exemplos relacionados de pathlib.PureWindowsPath. Compare como os caminhos relativos que contêm elementos semelhantes a letras de unidade são classificados e normalizados, e use os snippets para verificar que os caminhos relativos permanecem relativos, enquanto os caminhos absolutos mantêm seu comportamento existente.