bpo-39899: os.path.expanduser(): don't guess other Windows users' home directories if the basename of the current user's home directory doesn't match their username. (GH-18841)

This makes `ntpath.expanduser()` match `pathlib.Path.expanduser()` in this regard, and is more in line with `posixpath.expanduser()`'s cautious approach.

Also remove the near-duplicate implementation of `expanduser()` in pathlib, and by doing so fix a bug where KeyError could be raised when expanding another user's home directory.

1 files changed, 15 insertions, 3 deletions

diff --git a/Lib/ntpath.py b/Lib/ntpath.py
index 6f77177..421db50 100644
--- a/Lib/ntpath.py
+++ b/Lib/ntpath.py
@@ -312,12 +312,24 @@ def expanduser(path):
             drive = ''
         userhome = join(drive, os.environ['HOMEPATH'])
 
+    if i != 1: #~user
+        # Try to guess user home directory.  By default all users directories
+        # are located in the same place and are named by corresponding
+        # usernames.  If current user home directory points to nonstandard
+        # place, this guess is likely wrong, and so we bail out.
+        current_user = os.environ.get('USERNAME')
+        if current_user != basename(userhome):
+            return path
+
+        target_user = path[1:i]
+        if isinstance(target_user, bytes):
+            target_user = os.fsdecode(target_user)
+        if target_user != current_user:
+            userhome = join(dirname(userhome), target_user)
+
     if isinstance(path, bytes):
         userhome = os.fsencode(userhome)
 
-    if i != 1: #~user
-        userhome = join(dirname(userhome), path[1:i])
-
     return userhome + path[i:]