[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
setuptools (changelog)	==84.0.0 → ==84.1.0

---

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

GHSA-xmj3-9gf7-h52w

More information

Details

Summary

On Windows, attacker-controlled content in a wheel's
.dist-info/namespace_packages.txt can cause setuptools' legacy wheel
installation path to create an __init__.py outside the requested
destination_eggdir.

The attacker can influence the destination path, but not the contents of
the created file.

Details

Tested setuptools commit:

6ead555c5fb29bc57fe6105b1bffc163f56fd558

Relevant source:

setuptools/wheel.py

SHA-256:

359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd

The relevant call path is:

Wheel(wheel_path).install_as_egg(destination)
→ _install_as_egg
→ _convert_metadata
→ _fix_namespace_packages

A wheel can provide attacker-controlled content in:

<distribution>.dist-info/namespace_packages.txt

The namespace value is eventually used approximately as:

mod_dir = os.path.join(destination_eggdir, *mod.split('.'))
mod_init = os.path.join(mod_dir, '__init__.py')

If mod is a Windows drive-qualified absolute path containing no dots,
mod.split('.') preserves it as a single component.
On Windows, os.path.join(destination_eggdir, absolute_component) discards
the original base directory and resolves to the attacker-supplied absolute
path.
The existing wheel filename and ZIP traversal checks do not validate this
metadata value before it is subsequently interpreted as a filesystem path.

```markdown

##### PoC

The reproduction was performed entirely inside a disposable temporary
directory.

Layout:

```text
sandbox/
    destination/
    outside/
    input/
    canary.txt

A synthetic wheel was created containing:

demo_pkg-1.0.dist-info/namespace_packages.txt

whose content was the absolute path of:

sandbox\outside

The real acquired setuptools implementation was then invoked:

setuptools.wheel.Wheel(synthetic_wheel).install_as_egg(
    sandbox_destination
)

The operation completed without exception.

Expected metadata was created under:

sandbox\destination\EGG-INFO

but setuptools also created:

sandbox\outside\__init__.py

The file did not exist before execution.

Its contents were:

__import__('pkg_resources').declare_namespace(__name__)

The unrelated canary remained byte-identical.

The sandbox was deleted after recording the evidence.

##### Impact

A crafted wheel can cause setuptools to create a fixed-content
`__init__.py` outside the intended installation directory at a
filesystem path influenced by the wheel, with the permissions of the
process performing the installation.

The demonstrated reproduction required the target parent directory to
already exist.

#### Severity
- CVSS Score: 1.0 / 10 (Low)
- Vector String: `CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N`

#### References
- [https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w](https://redirect.github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w)
- [https://github.com/pypa/setuptools/pull/5329](https://redirect.github.com/pypa/setuptools/pull/5329)
- [https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af](https://redirect.github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af)
- [https://github.com/pypa/setuptools/releases/tag/v84.1.0](https://redirect.github.com/pypa/setuptools/releases/tag/v84.1.0)
- [https://github.com/advisories/GHSA-xmj3-9gf7-h52w](https://redirect.github.com/advisories/GHSA-xmj3-9gf7-h52w)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xmj3-9gf7-h52w) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>pypa/setuptools (setuptools)</summary>

### [`v84.1.0`](https://redirect.github.com/pypa/setuptools/compare/v84.0.0...v84.1.0)

[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v84.0.0...v84.1.0)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/tektronix/python-package-ci-cd).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJweXRob24iXX0=-->

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (c3b4dfa) to head (7c3121c).

Additional details and impacted files

@@            Coverage Diff            @@
##              main     #1274   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            4         4           
  Lines          233       233           
  Branches        32        32           
=========================================
  Hits           233       233           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Test Results (macos)

path	passed	subtotal
tests/test_bump_version_in_files.py	5	5
tests/test_create_unique_testpypi_version.py	7	7
tests/test_find_unreleased_changelog_items.py	6	6
tests/test_update_development_dependencies.py	13	13
TOTAL	31	31

Link to workflow run

[github-actions]

Test Results (windows)

path	passed	subtotal
tests\test_bump_version_in_files.py	5	5
tests\test_create_unique_testpypi_version.py	7	7
tests\test_find_unreleased_changelog_items.py	6	6
tests\test_update_development_dependencies.py	13	13
TOTAL	31	31

Link to workflow run

[github-actions]

Test Results (ubuntu)

path	passed	subtotal
tests/test_bump_version_in_files.py	5	5
tests/test_create_unique_testpypi_version.py	7	7
tests/test_find_unreleased_changelog_items.py	6	6
tests/test_update_development_dependencies.py	13	13
TOTAL	31	31

Link to workflow run