From b7501776a12c15e64b6cdac1e3b903a00df7d285 Mon Sep 17 00:00:00 2001 From: David Lord Date: Fri, 12 Nov 2021 09:24:32 -0800 Subject: [PATCH] remove deprecated safe_join --- CHANGES.rst | 2 ++ docs/api.rst | 2 -- src/flask/__init__.py | 1 - src/flask/helpers.py | 24 ------------------------ 4 files changed, 2 insertions(+), 27 deletions(-) diff --git a/CHANGES.rst b/CHANGES.rst index cca2284f..2358e159 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -13,6 +13,8 @@ Unreleased - ``config.from_json`` is replaced by ``config.from_file(name, load=json.load)``. - ``json`` functions no longer take an ``encoding`` parameter. + - ``safe_join`` is removed, use ``werkzeug.utils.safe_join`` + instead. Version 2.0.2 diff --git a/docs/api.rst b/docs/api.rst index 09fc71a9..5eb8b693 100644 --- a/docs/api.rst +++ b/docs/api.rst @@ -218,8 +218,6 @@ Useful Functions and Classes .. autofunction:: send_from_directory -.. autofunction:: safe_join - .. autofunction:: escape .. autoclass:: Markup diff --git a/src/flask/__init__.py b/src/flask/__init__.py index 3e7198a6..e6987709 100644 --- a/src/flask/__init__.py +++ b/src/flask/__init__.py @@ -23,7 +23,6 @@ from .helpers import flash as flash from .helpers import get_flashed_messages as get_flashed_messages from .helpers import get_template_attribute as get_template_attribute from .helpers import make_response as make_response -from .helpers import safe_join as safe_join from .helpers import send_file as send_file from .helpers import send_from_directory as send_from_directory from .helpers import stream_with_context as stream_with_context diff --git a/src/flask/helpers.py b/src/flask/helpers.py index 7b8b0870..df6a14cb 100644 --- a/src/flask/helpers.py +++ b/src/flask/helpers.py @@ -11,7 +11,6 @@ from functools import update_wrapper from threading import RLock import werkzeug.utils -from werkzeug.exceptions import NotFound from werkzeug.routing import BuildError from werkzeug.urls import url_quote @@ -627,29 +626,6 @@ def send_file( ) -def safe_join(directory: str, *pathnames: str) -> str: - """Safely join zero or more untrusted path components to a base - directory to avoid escaping the base directory. - - :param directory: The trusted base directory. - :param pathnames: The untrusted path components relative to the - base directory. - :return: A safe path, otherwise ``None``. - """ - warnings.warn( - "'flask.helpers.safe_join' is deprecated and will be removed in" - " Flask 2.1. Use 'werkzeug.utils.safe_join' instead.", - DeprecationWarning, - stacklevel=2, - ) - path = werkzeug.utils.safe_join(directory, *pathnames) - - if path is None: - raise NotFound() - - return path - - def send_from_directory( directory: t.Union[os.PathLike, str], path: t.Union[os.PathLike, str],