From 02a4ab13593cc047d7a62a22facd43daf44e76ba Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Fri, 10 Apr 2026 17:02:22 +0100 Subject: [PATCH] gh-148337: Document `importlib.resources` security model (GH-148340) (cherry picked from commit 70b86e7829c42d36c80853ba9bf1da0d8464065b) Co-authored-by: Stan Ulbrych --- Doc/library/importlib.resources.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Doc/library/importlib.resources.rst b/Doc/library/importlib.resources.rst index 7a11f4fe069004..46eab78a22b66a 100644 --- a/Doc/library/importlib.resources.rst +++ b/Doc/library/importlib.resources.rst @@ -31,6 +31,12 @@ not** have to exist as physical files and directories on the file system: for example, a package and its resources can be imported from a zip file using :py:mod:`zipimport`. +.. warning:: + + :mod:`importlib.resources` follows the same security model as the built-in + :func:`open` function. Passing untrusted inputs to the functions + in this module is unsafe. + .. note:: This module provides functionality similar to `pkg_resources