From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Date: Sun, 12 Apr 2026 00:10:41 +0000 (+0200) Subject: [3.14] gh-148337: Document `importlib.resources` security model (GH-148340) (#148356) X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=47b916e213db940fccad0d10457afffd7d0e60c5;p=thirdparty%2FPython%2Fcpython.git [3.14] gh-148337: Document `importlib.resources` security model (GH-148340) (#148356) gh-148337: Document `importlib.resources` security model (GH-148340) (cherry picked from commit 70b86e7829c42d36c80853ba9bf1da0d8464065b) Co-authored-by: Stan Ulbrych --- diff --git a/Doc/library/importlib.resources.rst b/Doc/library/importlib.resources.rst index 7a11f4fe0690..46eab78a22b6 100644 --- a/Doc/library/importlib.resources.rst +++ b/Doc/library/importlib.resources.rst @@ -31,6 +31,12 @@ not** have to exist as physical files and directories on the file system: for example, a package and its resources can be imported from a zip file using :py:mod:`zipimport`. +.. warning:: + + :mod:`importlib.resources` follows the same security model as the built-in + :func:`open` function. Passing untrusted inputs to the functions + in this module is unsafe. + .. note:: This module provides functionality similar to `pkg_resources