Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download #8
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
This PR upgrades the setuptools dependency to version 78.1.1, which includes a fix for a known path traversal vulnerability.
The issue stemmed from unsafe handling of URLs in PackageIndex.download, allowing an attacker to write arbitrary files via crafted URLs.
Impact:
The vulnerability could potentially allow arbitrary file writes during package downloads, especially in scenarios using deprecated mechanisms like easy_install.
Fix:
setuptools>=78.1.1 introduces proper sanitization for filenames derived from URLs, mitigating the risk.
Note:
This change also ensures compatibility with poetry and avoids dependency resolution failures triggered by older versions of setuptools.
Related issue:
Dependabot #172
Check list: