René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Clarify the documentation of pathlib.Path.is_relative_to()","articleBody":"Hi,\r\n\r\nCurrently (python 3.10.6 \u0026 3.11.0):\r\n```python\r\nfrom pathlib import Path\r\n\r\np = Path('/var/log/../../opt')\r\np.is_relative_to('/var/log')\r\n\u003e\u003e\u003e True\r\n\r\np = p.resolve()\r\np.is_relative_to('/var/log')\r\n\u003e\u003e\u003e False\r\n```\r\nOnce you know `is_relative_to` uses `relative_to`, this makes more sense but it's not obvious from the documentation and the examples given. Also it can easily lead to code that looks secure but isn't. Case in point, I was tasked with reviewing this code today (simplified for illustration purposes):\r\n\r\n```python\r\npath = Path(ROOT_PATH, user_input_rel_path)\r\nif path.is_relative_to(ROOT_PATH):\r\n    path.unlink()\r\nelse:\r\n    raise PermissionError('Nope!')\r\n```\r\n\r\nI was unsure if I should open a bug or not because one could easily argue it isn't a bug. I do believe however that a warning in the documentation could save a few devs from making a mistake.\r\n\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-114031\n* gh-114460\n* gh-114461\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/thomas-mckay","@type":"Person","name":"thomas-mckay"},"datePublished":"2022-11-10T14:58:53.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":4},"url":"https://github.com/99334/cpython/issues/99334"}