From f3b14c43cd0b2c5dde8f7b707132c31c6a76cc01 Mon Sep 17 00:00:00 2001 From: cjames23 Date: Wed, 14 Oct 2026 21:14:40 -0700 Subject: [PATCH 1/2] Don't read mimetypes.knownfiles by default on Windows Make knownfiles empty on Windows so that only the registry is used by default. Files passed to init() or assigned to knownfiles explicitly are still read. --- Lib/mimetypes.py | 30 ++++++++++++------- Lib/test/test_mimetypes.py | 7 +++++ ...-10-15-03-47-08.gh-issue-159428.XHRKwY.rst | 2 ++ 3 files changed, 28 insertions(+), 11 deletions(-) create mode 100644 Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst diff --git a/Lib/mimetypes.py b/Lib/mimetypes.py index 1d6b33fe854c94..9a9d4d1670b376 100644 --- a/Lib/mimetypes.py +++ b/Lib/mimetypes.py @@ -23,6 +23,8 @@ read_mime_types(file) -- parse one file, return a dictionary or None """ +import sys + try: from _winapi import _mimetypes_read_windows_registry except ImportError: @@ -40,17 +42,23 @@ "suffix_map", "encodings_map", "types_map", "common_types" ] -knownfiles = [ - "/etc/mime.types", - "/etc/httpd/mime.types", # Mac OS X - "/etc/httpd/conf/mime.types", # Apache - "/etc/apache/mime.types", # Apache 1 - "/etc/apache2/mime.types", # Apache 2 - "/usr/local/etc/httpd/conf/mime.types", - "/usr/local/lib/netscape/mime.types", - "/usr/local/etc/httpd/conf/mime.types", # Apache 1.2 - "/usr/local/etc/mime.types", # Apache 1.3 - ] +# These paths resolve against the root of the current drive on Windows +# (e.g. C:\etc\mime.types), which unprivileged users can usually create. +# Only the registry is used by default. +if sys.platform == "win32": + knownfiles = [] +else: + knownfiles = [ + "/etc/mime.types", + "/etc/httpd/mime.types", # Mac OS X + "/etc/httpd/conf/mime.types", # Apache + "/etc/apache/mime.types", # Apache 1 + "/etc/apache2/mime.types", # Apache 2 + "/usr/local/etc/httpd/conf/mime.types", + "/usr/local/lib/netscape/mime.types", + "/usr/local/etc/httpd/conf/mime.types", # Apache 1.2 + "/usr/local/etc/mime.types", # Apache 1.3 + ] inited = False _db = None diff --git a/Lib/test/test_mimetypes.py b/Lib/test/test_mimetypes.py index 1e0f6664af0d06..8e39552dba8aa8 100644 --- a/Lib/test/test_mimetypes.py +++ b/Lib/test/test_mimetypes.py @@ -271,6 +271,10 @@ def test_init_knownfiles(self): mimetypes.init() self.assertEqual(guess_file_type("file.test2")[0], "testing/test2") + @unittest.skipIf(sys.platform == "win32", "non-Windows only") + def test_default_knownfiles(self): + self.assertIn("/etc/mime.types", knownfiles) + def test_added_types_are_used(self): mimetypes.add_type('testing/default-type', '') mime_type, _ = mimetypes.guess_type('') @@ -555,6 +559,9 @@ def test_registry_parsing(self): eq(self.db.guess_type("image.jpg"), ("image/jpeg", None)) eq(self.db.guess_type("image.png"), ("image/png", None)) + def test_default_knownfiles(self): + self.assertEqual(knownfiles, []) + @unittest.skipIf(not hasattr(_winapi, "_mimetypes_read_windows_registry"), "read_windows_registry accelerator unavailable") def test_registry_accelerator(self): diff --git a/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst b/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst new file mode 100644 index 00000000000000..d481ed2b74a20e --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst @@ -0,0 +1,2 @@ +:mod:`mimetypes` no longer reads the files listed in :data:`mimetypes.knownfiles` +by default on Windows, and uses only the registry. From a9878248c5a4e253fe2d8d971806a29c6d701a6c Mon Sep 17 00:00:00 2001 From: Cary Hawkins Date: Thu, 15 Oct 2026 07:57:03 -0700 Subject: [PATCH 2/2] Update Lib/mimetypes.py Co-authored-by: Steve Dower --- Lib/mimetypes.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Lib/mimetypes.py b/Lib/mimetypes.py index 9a9d4d1670b376..561b99a92c8d16 100644 --- a/Lib/mimetypes.py +++ b/Lib/mimetypes.py @@ -42,10 +42,10 @@ "suffix_map", "encodings_map", "types_map", "common_types" ] -# These paths resolve against the root of the current drive on Windows -# (e.g. C:\etc\mime.types), which unprivileged users can usually create. -# Only the registry is used by default. if sys.platform == "win32": + # The default paths would resolve to the root of the current drive on Windows + # (e.g. C:\etc\mime.types), which unprivileged users can usually create. + # Only the registry is used by default. knownfiles = [] else: knownfiles = [