Merge pull request #45472 from home-assistant/rc

homeassistant/components/mpd/manifest.json

@@ -2,6 +2,6 @@
   "domain": "mpd",
   "name": "Music Player Daemon (MPD)",
   "documentation": "https://www.home-assistant.io/integrations/mpd",
-  "requirements": ["python-mpd2==3.0.1"],
+  "requirements": ["python-mpd2==3.0.3"],
   "codeowners": ["@fabaff"]
 }

homeassistant/components/neato/manifest.json

@@ -4,7 +4,7 @@
   "config_flow": true,
   "documentation": "https://www.home-assistant.io/integrations/neato",
   "requirements": [
-    "pybotvac==0.0.19"
+    "pybotvac==0.0.20"
   ],
   "codeowners": [
     "@dshokouhi",

homeassistant/components/netatmo/manifest.json

@@ -3,7 +3,7 @@
   "name": "Netatmo",
   "documentation": "https://www.home-assistant.io/integrations/netatmo",
   "requirements": [
-    "pyatmo==4.2.1"
+    "pyatmo==4.2.2"
   ],
   "after_dependencies": [
     "cloud",

homeassistant/const.py

@@ -1,7 +1,7 @@
 """Constants used by Home Assistant components."""
 MAJOR_VERSION = 2021
 MINOR_VERSION = 1
-PATCH_VERSION = "4"
+PATCH_VERSION = "5"
 __short_version__ = f"{MAJOR_VERSION}.{MINOR_VERSION}"
 __version__ = f"{__short_version__}.{PATCH_VERSION}"
 REQUIRED_PYTHON_VER = (3, 7, 1)

homeassistant/util/__init__.py

@@ -33,13 +33,33 @@ RE_SANITIZE_PATH = re.compile(r"(~|\.(\.)+)")
 
 
 def sanitize_filename(filename: str) -> str:
-    r"""Sanitize a filename by removing .. / and \\."""
+    """Check if a filename is safe.
-    return RE_SANITIZE_FILENAME.sub("", filename)
+
+    Only to be used to compare to original filename to check if changed.
+    If result changed, the given path is not safe and should not be used,
+    raise an error.
+
+    DEPRECATED.
+    """
+    # Backwards compatible fix for misuse of method
+    if RE_SANITIZE_FILENAME.sub("", filename) != filename:
+        return ""
+    return filename
 
 
 def sanitize_path(path: str) -> str:
-    """Sanitize a path by removing ~ and .."""
+    """Check if a path is safe.
-    return RE_SANITIZE_PATH.sub("", path)
+
+    Only to be used to compare to original path to check if changed.
+    If result changed, the given path is not safe and should not be used,
+    raise an error.
+
+    DEPRECATED.
+    """
+    # Backwards compatible fix for misuse of method
+    if RE_SANITIZE_PATH.sub("", path) != path:
+        return ""
+    return path
 
 
 def slugify(text: str, *, separator: str = "_") -> str:

requirements_all.txt

@@ -1271,7 +1271,7 @@ pyarlo==0.2.4
 pyatag==0.3.4.4
 
 # homeassistant.components.netatmo
-pyatmo==4.2.1
+pyatmo==4.2.2
 
 # homeassistant.components.atome
 pyatome==0.1.1
@@ -1289,7 +1289,7 @@ pyblackbird==0.5
 # pybluez==0.22
 
 # homeassistant.components.neato
-pybotvac==0.0.19
+pybotvac==0.0.20
 
 # homeassistant.components.nissan_leaf
 pycarwings2==2.10
@@ -1780,7 +1780,7 @@ python-juicenet==1.0.1
 python-miio==0.5.4
 
 # homeassistant.components.mpd
-python-mpd2==3.0.1
+python-mpd2==3.0.3
 
 # homeassistant.components.mystrom
 python-mystrom==1.1.2

requirements_test_all.txt

@@ -646,7 +646,7 @@ pyarlo==0.2.4
 pyatag==0.3.4.4
 
 # homeassistant.components.netatmo
-pyatmo==4.2.1
+pyatmo==4.2.2
 
 # homeassistant.components.apple_tv
 pyatv==0.7.5
@@ -655,7 +655,7 @@ pyatv==0.7.5
 pyblackbird==0.5
 
 # homeassistant.components.neato
-pybotvac==0.0.19
+pybotvac==0.0.20
 
 # homeassistant.components.cloudflare
 pycfdns==1.2.1

tests/util/test_init.py

@@ -12,17 +12,17 @@ from tests.async_mock import MagicMock, patch
 def test_sanitize_filename():
     """Test sanitize_filename."""
     assert util.sanitize_filename("test") == "test"
-    assert util.sanitize_filename("/test") == "test"
+    assert util.sanitize_filename("/test") == ""
-    assert util.sanitize_filename("..test") == "test"
+    assert util.sanitize_filename("..test") == ""
-    assert util.sanitize_filename("\\test") == "test"
+    assert util.sanitize_filename("\\test") == ""
-    assert util.sanitize_filename("\\../test") == "test"
+    assert util.sanitize_filename("\\../test") == ""
 
 
 def test_sanitize_path():
     """Test sanitize_path."""
     assert util.sanitize_path("test/path") == "test/path"
-    assert util.sanitize_path("~test/path") == "test/path"
+    assert util.sanitize_path("~test/path") == ""
-    assert util.sanitize_path("~/../test/path") == "//test/path"
+    assert util.sanitize_path("~/../test/path") == ""
 
 
 def test_slugify():