[issue41043] Escape the literal part of the path for glob()

Change by Serhiy Storchaka : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue41043] Escape the literal part of the path for glob()

Serhiy Storchaka added the comment: New changeset e73896241e55f452656fd8070eb79f344091bca0 by Serhiy Storchaka in branch '3.8': [3.8] bpo-41043: Escape literal part of the path for glob(). (GH-20994). (GH-21277)

[issue41043] Escape the literal part of the path for glob()

Serhiy Storchaka added the comment: New changeset ecfecc2d6ce88ae71c783f0465a508c6a1b2f2b6 by Serhiy Storchaka in branch '3.9': [3.9] bpo-41043: Escape literal part of the path for glob(). (GH-20994). (GH-21275)

[issue41043] Escape the literal part of the path for glob()

Change by Serhiy Storchaka : -- pull_requests: +20426 pull_request: https://github.com/python/cpython/pull/21277 ___ Python tracker ___

[issue41043] Escape the literal part of the path for glob()

Change by Serhiy Storchaka : -- pull_requests: +20424 pull_request: https://github.com/python/cpython/pull/21275 ___ Python tracker ___

[issue41043] Escape the literal part of the path for glob()

Serhiy Storchaka added the comment: It may be not exactly what you meant, but see issue38144. This issue actually was opened after I looked how that feature can be used in the stdlib and found that most of uses of glob() are vulnerable. -- ___

[issue41043] Escape the literal part of the path for glob()

Petr Viktorin added the comment: Would it be worth it to add a "base" keyword argument to glob.glob? -- nosy: +petr.viktorin ___ Python tracker ___

[issue41043] Escape the literal part of the path for glob()

Serhiy Storchaka added the comment: New changeset 935586845815f5b4c7814794413f6a812d4bd45f by Serhiy Storchaka in branch 'master': bpo-41043: Escape literal part of the path for glob(). (GH-20994) https://github.com/python/cpython/commit/935586845815f5b4c7814794413f6a812d4bd45f --

[issue41043] Escape the literal part of the path for glob()

Change by Serhiy Storchaka : -- keywords: +patch pull_requests: +20169 stage: -> patch review pull_request: https://github.com/python/cpython/pull/20994 ___ Python tracker

[issue41043] Escape the literal part of the path for glob()

New submission from Serhiy Storchaka : It is common to use glob() as glob.glob(os.path.join(basedir, pattern)) But it does not work correctly if the base directory contains special globbing characters ('*', '?', '['). It is an uncommon case, so in most cases the code works. But when