From 112868414ece93d38bd138eec4156e47d9ce1f15 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Tue, 25 Aug 2026 22:40:14 -0500 Subject: [PATCH] Keep per-file resolve(): srcFilter patterns may escape src_dir --- esphome/arduino/library.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/esphome/arduino/library.py b/esphome/arduino/library.py index e33fde8deb..affa053741 100644 --- a/esphome/arduino/library.py +++ b/esphome/arduino/library.py @@ -200,17 +200,15 @@ def _collect_lib_sources( src_dir: str, src_filter: list[str], ) -> None: - root = read_path / src_dir - resolved_root = root.resolve() sources: list[Path] = [] dropped: list[str] = [] saw_header = False - for f in collect_filtered_files(root, src_filter): + for f in collect_filtered_files(read_path / src_dir, src_filter): path = Path(f) suffix = path.suffix if suffix in SRC_FILE_EXTENSIONS: - # Re-root on the resolved dir instead of a realpath() per file - sources.append(resolved_root / path.relative_to(root)) + # resolve() per file: srcFilter patterns may escape src_dir + sources.append(path.resolve()) elif suffix.lower() in _UNMAPPED_SOURCE_SUFFIXES: # A source-like suffix the case-sensitive map rejects (.CPP, # .ino) is a dropped compilation unit; headers fall through