[New-bugs-announce] [issue15196] os.path.realpath gets confused when symlinks include '..'

[Ben Longbons]

New submission from Ben Longbons <b.r.longbons at gmail.com>:

I encountered this bug with the following filesystem layout

project/build/bin/main-gdb.py -> ../src/main-gdb.py
project/build/src -> ../src/
project/src/main-gdb.py -> ../py/main-gdb.py
project/py/main-gdb.py

where root/py/main-gdb.py contains
import os
print(os.path.realpath(__file__))

Actual Result:
project/build/py/main-gdb.py
instead of 
project/py/main-gdb.py

The cause of this bug is the fact that os.path._resolve_link calls os.path.normpath, which is not symlink-safe.
Specically, this is bad:
os.path.normpath('project/build/src/../py/main-gdb.py')

The correct thing to do is never call normpath; instead leave .. components and pop off the last element after ensuring that the preceding directory is not a symlink.

This bug seems pretty severe to me, because it prevents imports from working.

Exact python --version and Debian package versions:
Python 2.6.7    (2.6.7-4)
Python 2.7.3rc2 (2.7.3~rc2-2.1)
Python 3.2.3    (3.2.3-1)

----------
components: Library (Lib)
messages: 164090
nosy: o11c
priority: normal
severity: normal
status: open
title: os.path.realpath gets confused when symlinks include '..'
versions: Python 2.6, Python 2.7, Python 3.2

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue15196>
_______________________________________