Reconsider

Author: Keno

base/initdefs.jl

@@ -307,10 +307,10 @@ function load_path_expand(env::AbstractString)::Union{String, Nothing}
             end
         end
         isempty(DEPOT_PATH) && return nothing
-        return abspath(DEPOT_PATH[1], "environments", name, project_names[end]; normalize=false)
+        return abspath(DEPOT_PATH[1], "environments", name, project_names[end]; safe=true)
     end
     # otherwise, it's a path
-    path = abspath(env; normalize=false)
+    path = abspath(env; safe=true)
     if isdir(path)
         # directory with a project file?
         for proj in project_names
@@ -337,7 +337,7 @@ function active_project(search_load_path::Bool=true)
         # there are backedges here from abspath(::AbstractString, ::String)
         project = project::String
         if !isfile_casesensitive(project) && basename(project) ∉ project_names
-            project = abspath(project, "Project.toml"; normalize=false)
+            project = abspath(project, "Project.toml"; safe=true)
         end
         return project
     end

base/loading.jl

@@ -964,7 +964,7 @@ function project_file_manifest_path(project_file::String)::Union{Nothing,String}
         manifest_path = get(cache.project_file_manifest_path, project_file, missing)
         manifest_path === missing || return manifest_path
     end
-    dir = abspath(dirname(project_file); normalize=false)
+    dir = abspath(dirname(project_file); safe=true)
     isfile_casesensitive(project_file) || return nothing
     d = parsed_toml(project_file)
     base_manifest = workspace_manifest(project_file)
@@ -1248,7 +1248,7 @@ function explicit_manifest_entry_load_spec(manifest_file::String, pkg::PkgId, en
     for slug in (version_slug(uuid, hash), version_slug(uuid, hash, 4))
         for depot in DEPOT_PATH
             path = joinpath(depot, "packages", pkg.name, slug)
-            ispath(path) && return PkgLoadSpec(entry_path(abspath(path; normalize=false), pkg.name, entryfile), syntax_version)
+            ispath(path) && return PkgLoadSpec(entry_path(abspath(path; safe=true), pkg.name, entryfile), syntax_version)
         end
     end
     # no depot contains the package, return missing to stop looking
@@ -2394,9 +2394,9 @@ function _include_dependency!(dep_list::Vector{Any}, track_dependencies::Bool,
                               track_content::Bool, path_may_be_dir::Bool)
     prev = source_path(nothing)
     if prev === nothing
-        path = abspath(_path)
+        path = abspath(_path; safe=true)
     else
-        path = joinpath(dirname(prev), _path)
+        path = normpath(joinpath(dirname(prev), _path); safe=true)
     end
     if !track_dependencies[]
         if !path_may_be_dir && !isfile(path)
@@ -3194,11 +3194,11 @@ evalfile(path::AbstractString, args::Vector) = evalfile(path, String[args...])
 # Used in Pkg.jl
 function load_path_setup_code(load_path::Bool=true)
     code = """
-    append!(empty!(Base.DEPOT_PATH), $(repr(map(x -> abspath(x; normalize=false), DEPOT_PATH))))
-    append!(empty!(Base.DL_LOAD_PATH), $(repr(map(x -> abspath(x; normalize=false), DL_LOAD_PATH))))
+    append!(empty!(Base.DEPOT_PATH), $(repr(map(x -> abspath(x; safe=true), DEPOT_PATH))))
+    append!(empty!(Base.DL_LOAD_PATH), $(repr(map(x -> abspath(x; safe=true), DL_LOAD_PATH))))
     """
     if load_path
-        load_path = map(x -> abspath(x; normalize=false), Base.load_path())
+        load_path = map(x -> abspath(x; safe=true), Base.load_path())
         path_sep = Sys.iswindows() ? ';' : ':'
         any(path -> path_sep in path, load_path) &&
             error("LOAD_PATH entries cannot contain $(repr(path_sep))")
@@ -3284,9 +3284,9 @@ function create_expr_cache(pkg::PkgId, input::PkgLoadSpec, output::String, outpu
     @nospecialize internal_stderr internal_stdout
     rm(output, force=true)   # Remove file if it exists
     output_o === nothing || rm(output_o, force=true)
-    depot_path = String[abspath(x; normalize=false) for x in DEPOT_PATH]
-    dl_load_path = String[abspath(x; normalize=false) for x in DL_LOAD_PATH]
-    load_path = String[abspath(x; normalize=false) for x in Base.load_path()]
+    depot_path = String[abspath(x; safe=true) for x in DEPOT_PATH]
+    dl_load_path = String[abspath(x; safe=true) for x in DL_LOAD_PATH]
+    load_path = String[abspath(x; safe=true) for x in Base.load_path()]
     # if pkg is a stdlib, append its parent Project.toml to the load path
     triggers = get(EXT_PRIMED, pkg, nothing)
     if triggers !== nothing
@@ -3344,7 +3344,7 @@ function create_expr_cache(pkg::PkgId, input::PkgLoadSpec, output::String, outpu
         Base.track_nested_precomp($(_pkg_str(vcat(Base.precompilation_stack, pkg))))
         Base.loadable_extensions = $(_pkg_str(loadable_exts))
         Base.precompiling_extension = $(loading_extension)
-        Base.include_package_for_output($(_pkg_str(pkg)), $(repr(abspath(input.path; normalize=false))), $(repr(input.julia_syntax_version)), $(repr(depot_path)), $(repr(dl_load_path)),
+        Base.include_package_for_output($(_pkg_str(pkg)), $(repr(abspath(input.path; safe=true))), $(repr(input.julia_syntax_version)), $(repr(depot_path)), $(repr(dl_load_path)),
             $(repr(load_path)), $(_pkg_str(concrete_deps)), $(repr(source_path(nothing))))
         """)
     close(io.in)

base/path.jl

@@ -373,45 +373,55 @@ julia> joinpath(["/home/myuser", "example.jl"])
 joinpath
 
 """
-    normpath(path::AbstractString)::String
+    normpath(path::AbstractString; safe=false)::String
 
-Normalize a path, removing "." and ".." entries and changing "/" to the canonical path separator
-for the system.
+Normalize a path, removing "." changing "/" to the canonical path separator for the system.
+If `safe` is false, also removes ".." entries.
+
+!!! warning
+    Normalization with `safe==false` may change the meaning of a path if the
+    directory immediately preceding a ".." entry is a symbolic link.
+    For example, if `a` is a symbolic link in `a/../b`, then this path will
+    resolve to `b` in the link target's parent directory. However,
+    `normpath("a/../b")` will return `b`, which will resolve `b` in the
+    current working directory.
+
+!!! compat "Julia 1.14"
+    The `safe` keyword argument was added in Julia 1.14.
 
 # Examples
 ```jldoctest
 julia> normpath("/home/myuser/../example.jl")
 "/home/example.jl"
 
+julia> normpath("/home/myuser/../example.jl"; safe=true)
+"/home/myuser/../example.jl"
+
 julia> normpath("Documents/Julia") == joinpath("Documents", "Julia")
 true
 ```
-
-!!! warning
-    Normalization may change the meaning of a path if the directory immediately
-    preceding a ".." entry is a symbolic link. For example, if `a` is a symbolic
-    link in `a/../b`, then this path will resolve to `b` in the link target's
-    parent directory. However, `normpath("a/../b")` will return `b`, which will
-    resolve `b` in the current working directory.
 """
-function normpath(path::String)
+function normpath(path::String; safe=false)
     isabs = isabspath(path)
     isdir = isdirpath(path)
     drive, path = splitdrive(path)
     parts = split(path, path_separator_re; keepempty=false)
     filter!(!=("."), parts)
-    while true
-        clean = true
-        for j = 1:length(parts)-1
-            if parts[j] != ".." && parts[j+1] == ".."
-                deleteat!(parts, j:j+1)
-                clean = false
-                break
+    if !safe
+        while true
+            clean = true
+            for j = 1:length(parts)-1
+                if parts[j] != ".." && parts[j+1] == ".."
+                    deleteat!(parts, j:j+1)
+                    clean = false
+                    break
+                end
             end
+            clean && break
         end
-        clean && break
     end
     if isabs
+        # N.B.: `..` at the beginning of a path may always be removed
         while !isempty(parts) && parts[1] == ".."
             popfirst!(parts)
         end
@@ -434,10 +444,10 @@ end
 Convert a set of paths to a normalized path by joining them together and removing
 "." and ".." entries. Equivalent to `normpath(joinpath(path, paths...))`.
 """
-normpath(a::AbstractString, b::AbstractString...) = normpath(joinpath(a,b...))
+normpath(a::AbstractString, b::AbstractString...; kwargs...) = normpath(joinpath(a,b...); kwargs...)
 
 """
-    abspath(path::AbstractString; normalize=true)::String
+    abspath(path::AbstractString; safe=false)::String
 
 Convert a path to an absolute path by adding the current directory if necessary.
 If `normalize` is true, also normalizes the path as in [`normpath`](@ref).
@@ -453,9 +463,9 @@ Which gives a path like `"/home/JuliaUser/data/"`.
 See also [`joinpath`](@ref), [`pwd`](@ref), [`expanduser`](@ref).
 
 !!! compat "Julia 1.14"
-    The `normalize` keyword argument was added in Julia 1.14.
+    The `safe` keyword argument was added in Julia 1.14.
 """
-function abspath(a::String; normalize=true)::String
+function abspath(a::String; safe=false)::String
     if !isabspath(a)
         cwd = pwd()
         a_drive, a_nodrive = splitdrive(a)
@@ -466,7 +476,7 @@ function abspath(a::String; normalize=true)::String
             a = joinpath(cwd, a)
         end
     end
-    return normalize ? normpath(a) : a
+    return normpath(a; safe)
 end
 
 """

test/loading.jl

@@ -1915,3 +1915,47 @@ module M58272_to end
         copy!(LOAD_PATH, old_load_path)
     end
 end
+
+# Test loading when project or depot paths contain the symlink/.. pattern
+if !Sys.iswindows() || Sys.windows_version() >= Sys.WINDOWS_VISTA_VER
+    @testset "symlink/.. in project or depot paths" begin
+        mktempdir() do dir
+            old_load_path = copy(LOAD_PATH)
+            old_active_project = Base.ACTIVE_PROJECT[]
+
+            # Create a symlinked subdirectory
+            symlink_dir = joinpath(dir, "project_symlink")
+            target_dir = joinpath(@__DIR__, "project", "deps", "Foo1", "src")
+            mkpath(target_dir)
+            symlink(target_dir, symlink_dir)
+            symlink_parent = joinpath(symlink_dir, "..")
+            try
+                # test symlink'd project path
+                Base.set_active_project(symlink_parent)
+                push!(empty!(LOAD_PATH), "@")
+
+                Foo1_uuid = Base.UUID("1a6589dc-c33c-4d54-9a54-f7fc4b3ff616")
+                id = Base.identify_package("Foo")
+                @test id.uuid == Foo1_uuid
+                located = Base.locate_package(id)
+                @test located !== nothing
+                @test samefile(located, joinpath(target_dir, "Foo.jl"))
+
+                # Test symlink'd depot path
+                symlink_depot = joinpath(dir, "depot_symlink")
+                target_dir = joinpath(@__DIR__, "depot", "packages")
+                symlink(target_dir, symlink_depot)
+                push!(empty!(LOAD_PATH), joinpath(@__DIR__, "project"))
+                push!(empty!(DEPOT_PATH), joinpath(symlink_depot, ".."))
+                pkg = Base.identify_package(
+                    Base.PkgId(Base.UUID("2a550a13-6bab-4a91-a4ee-dff34d6b99d0"), "Bar"), "Baz")
+                @test pkg !== nothing
+                @test samefile(Base.locate_package(pkg), joinpath(target_dir, "Baz", "81oLe", "src", "Baz.jl"))
+            finally
+                Base.ACTIVE_PROJECT[] = old_active_project
+                copy!(LOAD_PATH, old_load_path)
+                copy!(DEPOT_PATH, original_depot_path)
+            end
+        end
+    end
+end