konsti
a0e461ac44
Check that only files inside the installation scheme can be removed when uv uninstalls a package. This fixes a bug where uv would try to remove arbitrary files due to a malformed or malicious RECORD file in a wheel. For venvs, the installation prefix is the entire venv, as `.data/data` allows wheels to write to the entire venv, so all files in the venv can also be removed. This is both a correctness fix (uv should never remove files outside its domain) and a low severity security fix, where a malicious wheel could remove a user's files during uninstallation, such as a `uv sync` that upgrades the package version. Note that this requires an attacker having control over the wheel, which also allows them to modify arbitrary Python code. There are no known cases of wheels actually referencing files outside the installation scheme in their RECORD.
uv-dispatch
This crate is an internal component of uv. The Rust API exposed here is unstable and will have frequent breaking changes.
This version (0.0.38) is a component of uv 0.11.5. The source can be found here.
See uv's crate versioning policy for details on versioning.