os.path.realpath() does not handle symlinks properly on
Linux (at least, does not do it the same way as the
Linux file functions do).

To reproduce follow these steps:

mkdir a
mkdir a/k
mkdir a/l
mkdir a/k/x
mkdir a/k/y
cd a
ln -s k/y link-y
ls link-y/..

This outputs: x/  y/
In other words, link-y/.. == a/k

Now, while still in directory 'a' (in bash) execute on
one line: 
python -c 'import os.path'$'\n''print
os.path.realpath("link-y/..")'

This will print: /path/to/a
In other words: os.path.realpath('link-y/..') == a

That is, the link link-y has not been expanded to the
directory it points to before .. (go to parent
directory) has been applied to the path.

os.path.normpath() has the same problem.

This may be a potential security risk if one uses
realpath to check if a requested path is inside a
certain restricted subdirectory.

Logged In: YES 
user_id=469548

I've created a patch for realpath
(http://python.org/sf/996627) and a doc patch for normpath
(http://python.org/sf/996626). There's a comment in
posixpath.py warning for this problem with normpath, and
it's been there since 1992, so I don't think we should go
around changing it now.

Logged In: YES 
user_id=469548

The patches below have been checked in. Closing as fixed.