From f0ac849b160858c0a060f9cb19633aea375feca3 Mon Sep 17 00:00:00 2001 From: macayu17 Date: Wed, 1 Jul 2026 10:21:44 +0530 Subject: [PATCH] pyenv-binary: reject invalid version names and drop readlink -f in save A version is a single directory name under versions/, so refuse names with a slash or a dot-dot component before building the prefix path. Also emit the python paths directly instead of `readlink -f`, which BSD readlink on macOS does not support; ldd/otool follow the symlinks anyway, so the resolved paths were never needed. --- plugins/pyenv-binary/libexec/pyenv-binary-save | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/plugins/pyenv-binary/libexec/pyenv-binary-save b/plugins/pyenv-binary/libexec/pyenv-binary-save index 3ede5da9..fb818fcf 100755 --- a/plugins/pyenv-binary/libexec/pyenv-binary-save +++ b/plugins/pyenv-binary/libexec/pyenv-binary-save @@ -27,6 +27,15 @@ if [ -z "$version" ]; then exit 1 fi +# A version is a single directory name under versions/. Reject a name with a +# slash or a dot-dot component so it cannot point outside there. +case "$version" in +*/* | *..* ) + echo "pyenv-binary: invalid version name \`${version}'" >&2 + exit 1 + ;; +esac + prefix="${PYENV_ROOT}/versions/${version}" if [ ! -d "${prefix}/bin" ]; then echo "pyenv-binary: version \`${version}' is not installed" >&2 @@ -58,7 +67,7 @@ system_deps() { local f { for f in "${prefix}"/bin/python*; do - [ -e "$f" ] && readlink -f "$f" + [ -e "$f" ] && printf '%s\n' "$f" done find "${prefix}" -type f \( -name '*.so' -o -name '*.so.*' -o -name '*.dylib' \) } | sort -u | while IFS= read -r f; do