Skip to content

gh-74453: Add stronger security warning to os.path.commonprefix - #144401

Merged
encukou merged 3 commits into
python:mainfrom
sethmlarson:os-path-commonprefix
Feb 3, 2026
Merged

gh-74453: Add stronger security warning to os.path.commonprefix#144401
encukou merged 3 commits into
python:mainfrom
sethmlarson:os-path-commonprefix

Conversation

@sethmlarson

@sethmlarsonsethmlarson commented Feb 2, 2026•
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

The first part of closing #74453, this documentation update I believe is less controversial than a deprecation. I'm recommending backporting this warning, as all Python versions supported today have commonpath().

The mix-up that commonprefix is acceptable for generating a path prefix (versus a string prefix) occurred at least once in a critical packaging tool: https://www.cve.org/CVERecord?id=CVE-2026-1703 Given its usage (40K+ hits on GitHub) I suspect this is not the only occurrence.

📚 Documentation preview 📚: https://cpython-previews--144401.org.readthedocs.build/

@bedevere-appbedevere-appBot mentioned this pull request Feb 2, 2026
Closed
@bedevere-appbedevere-appBot added docs Documentation in the Doc dir skip news labels Feb 2, 2026
@sethmlarsonsethmlarson added type-security A security issue stdlib Standard Library Python modules in the Lib/ directory skip news and removed awaiting review skip news labels Feb 2, 2026
StanFromIreland
StanFromIreland reviewed Feb 2, 2026
View reviewed changes
Comment threadDoc/library/os.path.rst
StanFromIreland
StanFromIreland approved these changes Feb 2, 2026
View reviewed changes

@StanFromIrelandStanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

picnixz
picnixz reviewed Feb 2, 2026
View reviewed changes
Comment threadDoc/library/os.path.rst Outdated
(``''``).

.. note::
.. danger::

@picnixzpicnixzFeb 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do not often use "danger" but rather prefer using warning (I believe we have something about it in the devguide)

@sethmlarsonsethmlarsonFeb 2, 2026

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I've updated to warning instead of danger.

@StanFromIrelandStanFromIrelandFeb 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe we have something about it in the devguide

Out of curiosity, which section? I was unable to find any on these.

@sethmlarsonsethmlarsonFeb 2, 2026

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe here? https://devguide.python.org/documentation/markup/#paragraph-level-markup

@picnixzpicnixzFeb 2, 2026•
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes here. It is just so that we do not have a proliferation of different boxes (while Sphinx and docutils provide lots of boxes we tend to only use a few of them). In addition other security warnings were usually indicated through a warning.

Though if we actually use danger/important instead of warning, feel free to revert my suggestion (from what I remember we mostly used warning)

vstinner
vstinner approved these changes Feb 3, 2026
View reviewed changes

@vstinnervstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

IMO we should still consider deprecating os.path.commonprefix() and add string.commonprefix() instead. But this doc change is a good start :-)

@sethmlarson

sethmlarson commented Feb 3, 2026

Copy link
Copy Markdown
ContributorAuthor

@vstinner Thanks! I'm working on a PR that deprecates the function and moves it to string.commonprefix().

@encukou
encukou merged commit 4e15b8d into python:mainFeb 3, 2026
47 of 56 checks passed
@github-project-automationgithub-project-automationBot moved this from Todo to Done in Docs PRsFeb 3, 2026
@encukouencukou added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Feb 3, 2026
@miss-islington-app

miss-islington-appBot commented Feb 3, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-appBot commented Feb 3, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-appBot commented Feb 3, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-appBot commented Feb 3, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-appBot commented Feb 3, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 3, 2026
@sethmlarson@miss-islington
pythongh-74453: Add stronger security warning to os.path.commonprefix (…
64cd146
…pythonGH-144401)
(cherry picked from commit 4e15b8d)
Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app

bedevere-appBot commented Feb 3, 2026

Copy link
Copy Markdown

GH-144426 is a backport of this pull request to the 3.10 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.10 only security fixes label Feb 3, 2026
@bedevere-app

bedevere-appBot commented Feb 3, 2026

Copy link
Copy Markdown

GH-144427 is a backport of this pull request to the 3.12 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.12 only security fixes label Feb 3, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 3, 2026
@sethmlarson@miss-islington
pythongh-74453: Add stronger security warning to os.path.commonprefix (…
b8da7eb
…pythonGH-144401)
(cherry picked from commit 4e15b8d)
Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app

bedevere-appBot commented Feb 3, 2026

Copy link
Copy Markdown

GH-144428 is a backport of this pull request to the 3.11 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.11 only security fixes label Feb 3, 2026
@bedevere-app

bedevere-appBot commented Feb 3, 2026

Copy link
Copy Markdown

GH-144429 is a backport of this pull request to the 3.13 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.13 bugs and security fixes label Feb 3, 2026
@bedevere-app

bedevere-appBot commented Feb 3, 2026

Copy link
Copy Markdown

GH-144430 is a backport of this pull request to the 3.14 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.14 bugs and security fixes label Feb 3, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 3, 2026
@sethmlarson@miss-islington
pythongh-74453: Add stronger security warning to os.path.commonprefix (…
9a217af
…pythonGH-144401)
(cherry picked from commit 4e15b8d)
Co-authored-by: Seth Michael Larson <seth@python.org>
sethmlarson added a commit that referenced this pull request Feb 3, 2026
@miss-islington@sethmlarson
[3.13]gh-74453: Add stronger security warning to os.path.commonprefix
5e88899
gh-74453: Add stronger security warning to os.path.commonprefix (GH-144401)
(cherry picked from commit 4e15b8d)
Co-authored-by: Seth Michael Larson <seth@python.org>
@sethmlarson
sethmlarson deleted the os-path-commonprefix branch February 3, 2026 14:16
sethmlarson added a commit that referenced this pull request Feb 3, 2026
@miss-islington@sethmlarson
[3.14]gh-74453: Add stronger security warning to os.path.commonprefix
eb0790f
gh-74453: Add stronger security warning to os.path.commonprefix (GH-144401)
(cherry picked from commit 4e15b8d)
Co-authored-by: Seth Michael Larson <seth@python.org>
sethmlarson added a commit that referenced this pull request Feb 3, 2026
@miss-islington@sethmlarson
[3.12]gh-74453: Add stronger security warning to os.path.commonprefix
276b9f2
gh-74453: Add stronger security warning to os.path.commonprefix (GH-144401)
(cherry picked from commit 4e15b8d)
Co-authored-by: Seth Michael Larson <seth@python.org>
sethmlarson added a commit that referenced this pull request Feb 3, 2026
@miss-islington@sethmlarson
[3.11]gh-74453: Add stronger security warning to os.path.commonprefix
11a1e4e
gh-74453: Add stronger security warning to os.path.commonprefix (GH-144401)
(cherry picked from commit 4e15b8d)
Co-authored-by: Seth Michael Larson <seth@python.org>
sethmlarson added a commit that referenced this pull request Feb 3, 2026
@miss-islington@sethmlarson
[3.10]gh-74453: Add stronger security warning to os.path.commonprefix
e3109d6
gh-74453: Add stronger security warning to os.path.commonprefix (GH-144401)
(cherry picked from commit 4e15b8d)
Co-authored-by: Seth Michael Larson <seth@python.org>
@sethmlarsonsethmlarson mentioned this pull request Feb 3, 2026
Merged
@sethmlarson

sethmlarson commented Feb 3, 2026

Copy link
Copy Markdown
ContributorAuthor

I've created the follow-up PR which deprecates os.path.commonprefix: #144436

Aniketsy pushed a commit to Aniketsy/cpython that referenced this pull request Feb 3, 2026
@sethmlarson@Aniketsy
pythongh-74453: Add stronger security warning to os.path.commonprefix (…
c3b31ea
…pythonGH-144401)
thunder-coding pushed a commit to thunder-coding/cpython that referenced this pull request Feb 15, 2026
@sethmlarson@thunder-coding
pythongh-74453: Add stronger security warning to os.path.commonprefix (…
6d3c7f6
…pythonGH-144401)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIrelandStanFromIrelandStanFromIreland approved these changes
@vstinnervstinnervstinner approved these changes
@picnixzpicnixzpicnixz approved these changes

Assignees

No one assigned

Labels

awaiting mergedocsDocumentation in the Doc dirskip newsstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Projects

Docs PRs
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@sethmlarson@vstinner@picnixz@StanFromIreland@encukou