Skip to content

fix: skip symlinks that resolve outside the recursed directory - #382

Open
abdul7056 wants to merge 1 commit into
PyCQA:mainfrom
abdul7056:skip-symlinks-outside-root
Open

abdul7056 wants to merge 1 commit into
PyCQA:mainfrom
abdul7056:skip-symlinks-outside-root

Conversation

@abdul7056

Copy link
Copy Markdown

Repro: run autoflake --recursive --in-place proj on a tree where proj/link.py is a symlink to a Python file outside proj/. The target file is rewritten, so a checked-out repository can point the in-place edit at any Python file the user can write.
Cause: find_files passes every file symlink reported by os.walk() on to fix_file, which reads and writes through the link. Directory symlinks were already not followed, so file symlinks were the only way out of the tree.
Fix: skip, before the file is opened, any symlink in the recursive walk whose resolved target is not under the resolved walk root. Symlinks that stay within the tree and files named explicitly on the command line are unchanged. Added a find_files regression test that fails on the old code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant