Repository navigation
drive designator handling issue in template URI normalization on Windows #441
Description
Summary
There is an inconsistency in how drive designators are handled during URI normalization in template lookup on Windows, which can lead to incorrect path resolution.
Details will be updated when fix is provided.
Activity
sqla-tester commentedon Sep 22, 2026
Mike Bayer has proposed a fix for this issue in the main branch:
Fix path traversal via drive designator URI on Windows in TemplateLookup https://gerrit.sqlalchemy.org/c/sqlalchemy/mako/+/6989
zzzeek commentedon Sep 22, 2026
Reopening: the test matrix added with this fix cannot run on Windows.
TemplateLookup.get_template()converts the configured directory withdir_.replace(os.path.sep, posixpath.sep). The new parametrized test forcesos.path = posixpathin order to exercise both platforms' semantics, but on a real Windows host that makesos.path.sepequal to/, so the genuine backslashes in the temporary directory path are never converted and the template is not found at all. The eleven-posixrows therefore fail withTopLevelLookupExceptioninstead of reaching the traversal check.The library itself is not affected; the
-windowsrows pass on Windows and the whole matrix passes on Linux and macOS. This is a test-only regression in 1.4.2.sqla-tester commentedon Sep 22, 2026
Mike Bayer has proposed a fix for this issue in the main branch:
Skip posix path traversal test rows on a Windows filesystem https://gerrit.sqlalchemy.org/c/sqlalchemy/mako/+/6990
Fix path traversal via drive designator URI on Windows in TemplateLookup
Skip posix path traversal test rows on a Windows filesystem