Repository navigation
Conversation
The tar_file_with_sym_link fixture calls os.symlink unconditionally, which raises OSError (WinError 1314) on unprivileged Windows and errors the whole test_tar_extract_insecure_files parametrization in setup. CI stays green because GitHub's Windows runner can create symlinks. Guard the fixture with pytest.skip (matching the skipif(os.name=='nt') guard already used in test_data_files.py) and resolve fixtures lazily so the dot-dot and sibling-prefix security cases still run on Windows. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
tests/test_extract.py::test_tar_extract_insecure_fileserrors in setup on anunprivileged Windows machine:
The
tar_file_with_sym_linkfixture callsos.symlink(...)unconditionally, andthe test requests all three tar fixtures eagerly — so on Windows every
parametrization (dot-dot, symlink, sibling-prefix) errors, not just the symlink one.
CI stays green because GitHub's Windows runner can create symlinks; a normal
Windows contributor (no elevation, Developer Mode off) cannot, so the suite is red
for them and has been silently.
Fix
pytest.skipwhenos.symlinkfails — the same intent asthe
@pytest.mark.skipif(os.name == "nt", ...)guard already used intests/test_data_files.py::test_resolve_pattern_locally_does_not_resolve_symbolic_links.request.getfixturevalue(...), so onlythe symlink case skips on Windows — the dot-dot and sibling-prefix security cases
still run there, which they didn't before this PR (they were collateral of the
eager fixture).
Behaviour is unchanged everywhere symlinks are available (all current CI, and any
elevated / Developer-Mode machine): all three cases run exactly as today.
Note
Verified with
py_compileand by inspection; I don't have an unprivileged-Windowsrunner to execute the skip path in CI, so a maintainer confirming it there (skips
only the symlink case, still runs the other two) would be welcome.
🤖 Generated with Claude Code