From 07171ebd6bb55e2e03e8300a3273e8f4ae7150ba Mon Sep 17 00:00:00 2001 From: Nikhil Chaudhary Date: Fri, 24 Jul 2026 23:32:30 +0530 Subject: [PATCH] fix: prevent backward relative paths in readme --- backend/src/hatchling/metadata/core.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/backend/src/hatchling/metadata/core.py b/backend/src/hatchling/metadata/core.py index 44dea4686..fb1a3cdbc 100644 --- a/backend/src/hatchling/metadata/core.py +++ b/backend/src/hatchling/metadata/core.py @@ -528,6 +528,9 @@ def readme(self) -> str: raise TypeError(message) readme_path = os.path.normpath(os.path.join(self.root, readme)) + if os.path.isabs(readme) or os.path.relpath(readme_path, self.root).startswith(".."): + message = f"Readme path must be within the project directory: {readme}" + raise ValueError(message) if not os.path.isfile(readme_path): message = f"Readme file does not exist: {readme}" raise OSError(message) @@ -565,6 +568,9 @@ def readme(self) -> str: raise TypeError(message) path = os.path.normpath(os.path.join(self.root, relative_path)) + if os.path.isabs(relative_path) or os.path.relpath(path, self.root).startswith(".."): + message = f"Readme path must be within the project directory: {relative_path}" + raise ValueError(message) if not os.path.isfile(path): message = f"Readme file does not exist: {relative_path}" raise OSError(message)