File CVE-2025-47273.patch of Package python39-setuptools.38809

From 250a6d17978f9f6ac3ac887091f2d32886fbbb0b Mon Sep 17 00:00:00 2001
From: "Jason R. Coombs" <jaraco@jaraco.com>
Date: Sat, 19 Apr 2025 13:03:47 -0400
Subject: [PATCH] Add a check to ensure the name resolves relative to the
 tmpdir.

Closes #4946
---
 setuptools/package_index.py | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

Index: setuptools-44.1.1/setuptools/package_index.py
===================================================================
--- setuptools-44.1.1.orig/setuptools/package_index.py
+++ setuptools-44.1.1/setuptools/package_index.py
@@ -809,6 +809,9 @@ class PackageIndex(Environment):
             name = name[:-4]  # strip the extra .zip before download
 
         filename = os.path.join(tmpdir, name)
+        # ensure path resolves within the tmpdir
+        if not filename.startswith(str(tmpdir)):
+            raise ValueError("Invalid filename %s" % filename)
 
         return self._download_vcs(url, filename) or self._download_other(url, filename)