From 608f7e94281d9f54ee5a34d0b9a09c69a3ddb148 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Oct 02 2019 14:59:10 +0000
Subject: joinpath function


---

diff --git a/koji/util.py b/koji/util.py
index 4b2a3a7..a0f1835 100644
--- a/koji/util.py
+++ b/koji/util.py
@@ -512,6 +512,22 @@ def relpath(*args, **kwargs):
     return os.path.relpath(*args, **kwargs)
 
 
+
+def joinpath(path, *paths):
+    """A wrapper around os.path.join that limits directory traversal"""
+
+    # note that the first path is left alone
+
+    newpaths = []
+    for _p in paths:
+        p = os.path.normpath(_p)
+        if p == '..' or p.startswith('../') or p.startswith('/'):
+            raise ValueError('Invalid path segment: %s' % _p)
+        newpaths.append(p)
+
+    return os.path.join(path, *newpaths)
+
+
 def eventFromOpts(session, opts):
     """Determine event id from standard cli options