uranusjr commented on code in PR #70665:
URL: https://github.com/apache/airflow/pull/70665#discussion_r3672274918
##########
providers/imap/src/airflow/providers/imap/hooks/imap.py:
##########
@@ -322,7 +322,11 @@ def _is_symlink(self, name: str) -> bool:
return os.path.islink(name)
def _is_escaping_current_directory(self, name: str) -> bool:
- return f"..{os.sep}" in name
+ # Windows also accepts "/" as a path separator, so a "../" attachment
name
+ # traverses there even though os.sep is a backslash and the old
+ # f"..{os.sep}" check missed it. Normalise both separators and reject
any
+ # ".." path component.
+ return any(part == ".." for part in name.replace("\\", "/").split("/"))
Review Comment:
Non-Windows platforms treat backslashes differently, so this unconditional
replacement is wrong. Use `os.altsep` and `os.sep` instead.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
