beam: harden is_within boundary via commonpath

wizard-work/beam/path_sandbox.py

@@ -95,6 +95,10 @@ def is_within(root, target):
         rt = os.path.realpath(target)
     except (OSError, ValueError):
         return False
-    if rr == os.sep:
-        return rt == rr or rt.startswith(rr)
-    return rt == rr or rt.startswith(rr + os.sep)
+    # Use commonpath rather than a raw string prefix so that a root like
+    # /tmp/root cannot be confused with a sibling like /tmp/rootX.
+    try:
+        cp = os.path.commonpath([rr, rt])
+    except ValueError:
+        return False
+    return cp == rr