From 984a5f021a01158cf0fc0691fde34e6575d13da0 Mon Sep 17 00:00:00 2001 From: chrg6 Date: Mon, 9 Nov 2026 05:57:21 -0500 Subject: [PATCH] Check zbic's unpacked paths with is_relative_to, which a sibling folder cannot pass. Co-Authored-By: Claude Opus 5.5 --- launcher/toolchain.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/launcher/toolchain.py b/launcher/toolchain.py index ba8c73c7..cf88fc87 100644 --- a/launcher/toolchain.py +++ b/launcher/toolchain.py @@ -331,7 +331,7 @@ def ensure_zbic(layout, progress=None, cancel=None, log=print, version='dev'): with zipfile.ZipFile(dest) as z: for m in z.infolist(): target = (layout.pydeps / m.filename).resolve() - if not str(target).startswith(str(layout.pydeps.resolve())): + if not target.is_relative_to(layout.pydeps.resolve()): # not a sibling such as pydeps2 either raise ToolchainError(f'{pick["filename"]}: unsafe path {m.filename}') z.extractall(layout.pydeps) dest.unlink(missing_ok=True)