File CVE-2026-1703.patch of Package python-pip.42577

From 4c651b70d60ed91b13663bcda9b3ed41748d0124 Mon Sep 17 00:00:00 2001
From: Seth Michael Larson <seth@python.org>
Date: Fri, 30 Jan 2026 09:49:11 -0600
Subject: [PATCH] Use os.path.commonpath() instead of commonprefix()

---
 news/+1ee322a1.bugfix.rst            | 1 +
 src/pip/_internal/utils/unpacking.py | 2 +-
 tests/unit/test_utils_unpacking.py   | 2 ++
 3 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 news/+1ee322a1.bugfix.rst

Index: pip-22.3.1/news/+1ee322a1.bugfix.rst
===================================================================
--- /dev/null
+++ pip-22.3.1/news/+1ee322a1.bugfix.rst
@@ -0,0 +1 @@
+Use a path-segment prefix comparison, not char-by-char.
Index: pip-22.3.1/src/pip/_internal/utils/unpacking.py
===================================================================
--- pip-22.3.1.orig/src/pip/_internal/utils/unpacking.py
+++ pip-22.3.1/src/pip/_internal/utils/unpacking.py
@@ -81,7 +81,7 @@ def is_within_directory(directory: str,
     abs_directory = os.path.abspath(directory)
     abs_target = os.path.abspath(target)
 
-    prefix = os.path.commonprefix([abs_directory, abs_target])
+    prefix = os.path.commonpath([abs_directory, abs_target])
     return prefix == abs_directory
 
 
Index: pip-22.3.1/tests/unit/test_utils_unpacking.py
===================================================================
--- pip-22.3.1.orig/tests/unit/test_utils_unpacking.py
+++ pip-22.3.1/tests/unit/test_utils_unpacking.py
@@ -202,6 +202,8 @@ def test_unpack_tar_unicode(tmpdir: Path
         (("parent/", "parent/sub"), True),
         # Test target outside parent
         (("parent/", "parent/../sub"), False),
+        # Test target sub-string of parent
+        (("parent/child", "parent/childfoo"), False),
     ],
 )
 def test_is_within_directory(args: Tuple[str, str], expected: bool) -> None: