Skip to content

fix(cache): normalize base path to prevent false-positive escape error with .. in cache_dir (#15295) - #15299

Open
voidstackloop wants to merge 1 commit into
pytest-dev:mainfrom
voidstackloop:fix/cache-escape-normpath
Open

voidstackloop wants to merge 1 commit into
pytest-dev:mainfrom
voidstackloop:fix/cache-escape-normpath

Conversation

@voidstackloop

Copy link
Copy Markdown

Description

Fixes #15295.

Since 9.2.0, Cache._join_within checks if the resolved path is inside �ase using path.is_relative_to(base). However, path is normalized using os.path.normpath(), whereas �ase was left un-normalized.

When cache_dir contains .. segments (e.g. cache_dir = ../.pytest_cache in pytest.ini or generated via tox oxworkdir), path.is_relative_to(base) fails because the prefix parts of the normalized path do not match the un-normalized �ase parts containing ... This triggered an immediate INTERNALERROR> ValueError: 'cache/lastfailed' is not allowed to escape the cache directory on startup.

Solution

  1. In Cache._join_within, normalize �ase = Path(os.path.normpath(base)) before resolving and verifying containment with path.is_relative_to(base).
  2. In Cache.init and Cache.cache_dir_from_config, wrap the configured cache directory with Path(os.path.normpath(...)) so that internal paths derived from _cachedir are clean and normalized.
  3. Added unit tests for _join_within with unnormalized base paths and a regression test for cache_dir containing .. in configuration.
  4. Added towncrier changelog newsfragment.

@pyba-chronographer pyba-chronographer Bot added the bot:chronographer:provided (automation) changelog entry is part of PR label Oct 29, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bot:chronographer:provided (automation) changelog entry is part of PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9.2.0: INTERNALERROR "'cache/lastfailed' is not allowed to escape the cache directory" when cache_dir contains ".."

1 participant