From 250a6d17978f9f6ac3ac887091f2d32886fbbb0b Mon Sep 17 00:00:00 2001
From: shaojiansong <shaojiansong@kylinos.cn>
Date: Wed, 15 Jul 2026 15:20:07 +0800
Origin: https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
Issue: https://atomgit.com/src-openeuler/python-setuptools/issues/17
Subject: [PATCH] Add a check to ensure the name resolves relative to the
 tmpdir.

Closes #4946

Fixes CVE-2025-47273
---
 setuptools/package_index.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/setuptools/package_index.py b/setuptools/package_index.py
index 3500c2d..e446333 100644
--- a/setuptools/package_index.py
+++ b/setuptools/package_index.py
@@ -857,7 +857,14 @@ class PackageIndex(Environment):
         # strip any extra .zip before download
         name = re.sub(r'\.egg\.zip$', '.egg', name)
 
-        return os.path.join(tmpdir, name)
+
+        filename = os.path.join(tmpdir, name)
+
+        # ensure path resolves within the tmpdir
+        if not filename.startswith(str(tmpdir)):
+            raise ValueError(f"Invalid filename {filename}")
+
+        return filename
 
     def _download_url(self, url, tmpdir):
         """
-- 
2.40.0.windows.1