distlib 0.4.2__tar.gz → 0.4.3__tar.gz

{distlib-0.4.2 → distlib-0.4.3}/CHANGES.rst

@@ -1,11 +1,20 @@
 Change log for ``distlib``
 --------------------------
 
-0.4.3 (future)
+0.4.4 (future)
 ~~~~~~~~~~~~~~
 
 Released: Not yet.
 
+0.4.3
+~~~~~
+
+Released: Not yet.
+
+- resources
+
+    - Removed too-restrictive check for escaping resources.
+
 0.4.2
 ~~~~~
 

{distlib-0.4.2 → distlib-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: distlib
-Version: 0.4.2
+Version: 0.4.3
 Summary: Distribution utilities
 Home-page: https://github.com/pypa/distlib
 Author: Vinay Sajip
@@ -30,6 +30,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development
 License-File: LICENSE.txt
+Dynamic: license-file
 
 |badge1| |badge2|
 

{distlib-0.4.2 → distlib-0.4.3}/distlib/__init__.py

@@ -6,7 +6,7 @@
 #
 import logging
 
-__version__ = '0.4.2'
+__version__ = '0.4.3'
 
 
 class DistlibException(Exception):

{distlib-0.4.2 → distlib-0.4.3}/distlib/resources.py

@@ -153,11 +153,13 @@ class ResourceFinder(object):
         parts.insert(0, self.base)
         result = os.path.join(*parts)
         result = self._adjust_path(result)
+        # See issue 263: code below commented out as it proved to be
+        # too aggressively cautious, causing problems in valid use case scenarios.
         # Confine the resolved resource to the package base so a resource
         # name containing '..' cannot read files outside the package.
-        if not self._is_in_base(result):
-            raise DistlibException('Resource name escapes package: '
-                                   '%r' % resource_name)
+        # if not self._is_in_base(result):
+            # raise DistlibException('Resource name escapes package: '
+                                   # '%r' % resource_name)
         return result
 
     def _find(self, path):

{distlib-0.4.2 → distlib-0.4.3}/distlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: distlib
-Version: 0.4.2
+Version: 0.4.3
 Summary: Distribution utilities
 Home-page: https://github.com/pypa/distlib
 Author: Vinay Sajip
@@ -30,6 +30,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development
 License-File: LICENSE.txt
+Dynamic: license-file
 
 |badge1| |badge2|
 

distlib-0.4.3/pyproject.toml

@@ -0,0 +1,8 @@
+[build-system]
+requires = [
+    # "setuptools >= 68,<75", # For metadata 2.1
+    # "setuptools==75.8.0", # for metadata 2.2
+    "setuptools >= 68", # for metadata 2.4
+    "wheel"
+]
+build-backend = 'setuptools.build_meta'

{distlib-0.4.2 → distlib-0.4.3}/tests/test_resources.py

@@ -168,20 +168,20 @@ class FileResourceTestCase(DistlibTestCase):
         r = f.find('no_such_resource.bin')
         self.assertIsNone(r)
 
-    def test_escaping_resource(self):
-        f = finder('foofoo')
-        escapes = (
-            '../included.json',
-            '../../tests/included.json',
-            'bar/../../included.json',
-        )
-        for path in escapes:
-            with self.assertRaises(DistlibException) as ctx:
-                r = f.find(path)
-            self.assertIn('Resource name escapes package:', str(ctx.exception))
-        # Allow a non-escaping resource which happens to have .. in it
-        r = f.find('bar/../bar/bar_resource.bin')
-        self.assertTrue(r)
+    # def test_escaping_resource(self):
+        # f = finder('foofoo')
+        # escapes = (
+            # '../included.json',
+            # '../../tests/included.json',
+            # 'bar/../../included.json',
+        # )
+        # for path in escapes:
+            # with self.assertRaises(DistlibException) as ctx:
+                # r = f.find(path)
+            # self.assertIn('Resource name escapes package:', str(ctx.exception))
+        # # Allow a non-escaping resource which happens to have .. in it
+        # r = f.find('bar/../bar/bar_resource.bin')
+        # self.assertTrue(r)
 
     def test_contents(self):
         f = finder('foofoo')

distlib-0.4.2/pyproject.toml

@@ -1,6 +0,0 @@
-[build-system]
-requires = [
-    "setuptools >= 68,<75",
-    "wheel"
-]
-build-backend = 'setuptools.build_meta'