Skip to content

Avoid implicit file reads from string calendar input#1362

Open
uwezkhan wants to merge 4 commits into
collective:mainfrom
uwezkhan:fix/explicit-from-ical-file-paths
Open

Avoid implicit file reads from string calendar input#1362
uwezkhan wants to merge 4 commits into
collective:mainfrom
uwezkhan:fix/explicit-from-ical-file-paths

Conversation

@uwezkhan
Copy link
Copy Markdown
Contributor

@uwezkhan uwezkhan commented May 6, 2026

This PR hardens Component.from_ical() by removing ambiguous string-path handling.

Previously, a newline-free str passed to from_ical() was treated as a possible filesystem path. If that path existed, the parser read the file contents automatically. This made it easy for applications that pass untrusted strings into Calendar.from_ical() / Component.from_ical() to accidentally allow local file reads or file-content disclosure through parser errors.

After this change:

  • Path input still reads an iCalendar file explicitly.
  • bytes and str input are treated only as iCalendar payload data.
  • Regression tests verify string paths are not read and file contents are not leaked.

@read-the-docs-community
Copy link
Copy Markdown

read-the-docs-community Bot commented May 6, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant