{"id":"d55801d64dd7969f","repo":"pypa/pip","slug":"use-of-or-absolute-path-in-a-resource-path-is-n","errorCode":null,"errorMessage":"Use of .. or absolute path in a resource path is not allowed.","messagePattern":"Use of \\.\\. or absolute path in a resource path is not allowed\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"src/pip/_vendor/pkg_resources/__init__.py","lineNumber":1818,"sourceCode":"        >>> vrp(None)\n        Traceback (most recent call last):\n        ...\n        AttributeError: ...\n        \"\"\"\n        invalid = (\n            os.path.pardir in path.split(posixpath.sep)\n            or posixpath.isabs(path)\n            or ntpath.isabs(path)\n            or path.startswith(\"\\\\\")\n        )\n        if not invalid:\n            return\n\n        msg = \"Use of .. or absolute path in a resource path is not allowed.\"\n\n        # Aggressively disallow Windows absolute paths\n        if (path.startswith(\"\\\\\") or ntpath.isabs(path)) and not posixpath.isabs(path):\n            raise ValueError(msg)\n\n        # for compatibility, warn; in future\n        # raise ValueError(msg)\n        issue_warning(\n            msg[:-1] + \" and will raise exceptions in a future release.\",\n            DeprecationWarning,\n        )\n\n    def _get(self, path) -> bytes:\n        if hasattr(self.loader, 'get_data') and self.loader:\n            # Already checked get_data exists\n            return self.loader.get_data(path)  # type: ignore[attr-defined]\n        raise NotImplementedError(\n            \"Can't perform this operation for loaders without 'get_data()'\"\n        )\n\n\nregister_loader_type(object, NullProvider)","sourceCodeStart":1800,"sourceCodeEnd":1836,"githubUrl":"https://github.com/pypa/pip/blob/d7d0d0a39494e28ec1c407bd0680e4a4d1067791/src/pip/_vendor/pkg_resources/__init__.py#L1800-L1836","documentation":"Raised as ValueError by NullProvider._validate_resource_path when a resource name is a Windows-style absolute path — specifically when it starts with a backslash or is absolute under ntpath semantics while not being a posix-absolute path. For posix-absolute paths and '..' traversal segments the method currently only emits a DeprecationWarning (and states it will raise in a future release), but Windows absolute paths are hard-rejected now. This enforces that resource names use forward-slash relative paths, never os.path-joined absolute or parent-traversal paths.","triggerScenarios":"Passing a resource_name like '\\\\share\\file', 'C:\\data\\file.txt', or any backslash-leading/drive-prefixed string to resource access APIs (resource_filename, resource_string, has_resource, etc.). _validate_resource_path is called by _fn on every resource path.","commonSituations":"Accidentally using os.path.join or a Windows path variable as a resource name instead of a forward-slash relative name; security-sensitive code rejecting path traversal; code that worked on POSIX but hard-fails on Windows due to backslash handling.","solutions":["Always build resource names with forward slashes as relative paths: use posixpath.join or literal 'pkg/data.txt' strings, never os.path.join with OS separators.","Strip/normalize any user-supplied path: reject leading backslash/drive letters and '..' segments before passing to pkg_resources.","For absolute or traversal-prone inputs, resolve them outside pkg_resources (e.g. via pathlib) rather than passing through the resource API."],"exampleFix":"// before\nimport os\npath = pkg_resources.resource_filename('pkg', os.path.join('data', 'f.txt'))  # ValueError on Windows\n\n// after\npath = pkg_resources.resource_filename('pkg', 'data/f.txt')  # forward-slash relative","handlingStrategy":"validation","validationCode":"import posixpath, ntpath, os\n\ndef valid_resource_path(name):\n    if not isinstance(name, str):\n        return False\n    invalid = (\n        os.path.pardir in name.split(posixpath.sep)\n        or posixpath.isabs(name)\n        or ntpath.isabs(name)\n        or name.startswith('\\\\')\n    )\n    return not invalid","typeGuard":"import posixpath, ntpath, os\n\ndef is_safe_resource_path(name: str) -> bool:\n    return isinstance(name, str) and not (\n        os.path.pardir in name.split(posixpath.sep)\n        or posixpath.isabs(name)\n        or ntpath.isabs(name)\n        or name.startswith('\\\\')\n    )","tryCatchPattern":"try:\n    path = pkg_resources.resource_filename(pkg, name)\nexcept ValueError as e:\n    if 'resource path' in str(e):\n        raise ValueError(f'unsafe resource name {name!r}') from e\n    raise","preventionTips":["Build resource names with forward slashes as relative paths, never os.path.join.","Reject '..' and absolute/backslash paths from user input before the resource API.","Use posixpath.join (not os.path.join) when assembling resource names."],"tags":["pkg-resources","resource-path","security","windows","path-traversal"],"analyzedSha":"d7d0d0a39494e28ec1c407bd0680e4a4d1067791","analyzedAt":"2026-08-04T20:55:04.259Z","schemaVersion":2}