gh-160420: Reject drive letters in ZoneInfo key components on Windows (GH-160421)

A key such as "America/C:\file" passed validation, and the tzdata
loader then joined "C:\file" to the package directory, which replaced it.

ANT-2026-IZMAOLCQ

Author: gpshead

Lib/test/test_zoneinfo/test_zoneinfo.py

@@ -6,16 +6,19 @@
 import importlib.metadata
 import io
 import json
+import ntpath
 import os
 import pathlib
 import pickle
 import re
 import shutil
 import struct
 import tempfile
+import types
 import unittest
 from datetime import date, datetime, time, timedelta, timezone
 from functools import cached_property
+from unittest import mock
 
 from test.support import MISSING_C_DOCSTRINGS
 from test.support.os_helper import EnvironmentVarGuard, FakePath
@@ -2016,6 +2019,38 @@ def test_tzpath_type_error(self):
                 with self.assertRaises(TypeError):
                     self.module.reset_tzpath(bad_value)
 
+    def test_validate_key_windows_paths(self):
+        # Check the key validation with Windows path rules on every platform.
+        tzpath = self.module._tzpath
+        base = ntpath.normpath(ntpath.join("_", "_"))[:-1]
+        fake_os = types.SimpleNamespace(path=ntpath)
+
+        good_keys = [
+            "UTC",
+            "America/New_York",
+            "America/Argentina/Buenos_Aires",
+            "Etc/GMT+1",
+        ]
+        bad_keys = [
+            "C:\\Windows\\win.ini",
+            "America/C:\\Windows\\win.ini",  # Drive in a component
+            "America/C:/Windows/win.ini",
+            "America/D:secret",  # Drive-relative component
+            "America/Argentina/D:secret",
+            "America/\\Windows\\win.ini",  # Rooted component
+            "America/\\\\server\\share\\file",  # UNC component
+        ]
+
+        with mock.patch.object(tzpath, "os", fake_os):
+            for key in good_keys:
+                with self.subTest(key=key):
+                    tzpath._validate_tzfile_path(key, _base=base)
+
+            for key in bad_keys:
+                with self.subTest(key=key):
+                    with self.assertRaises(ValueError):
+                        tzpath._validate_tzfile_path(key, _base=base)
+
     def test_tzpath_attribute(self):
         tzpath_0 = [f"{DRIVE}/one", f"{DRIVE}/two"]
         tzpath_1 = [f"{DRIVE}/three"]

Lib/zoneinfo/_tzpath.py

@@ -111,6 +111,17 @@ def _validate_tzfile_path(path, _base=_TEST_PATH):
             f"ZoneInfo keys must refer to subdirectories of TZPATH, got: {path}"
         )
 
+    # load_tzdata() joins the last "/"-separated component of the key to the
+    # tzdata package directory on its own.  On Windows a component with a
+    # drive or root, such as "C:\\file" in "America/C:\\file", would replace
+    # that directory instead of being looked up inside it.
+    for component in path.split("/"):
+        drive, root, _ = os.path.splitroot(component)
+        if drive or root:
+            raise ValueError(
+                f"ZoneInfo keys must not contain drives or roots, got: {path}"
+            )
+
 
 del _TEST_PATH
 

Misc/NEWS.d/next/Security/2026-10-22-08-05-32.gh-issue-160420.tZ9dRv.rst

@@ -0,0 +1,4 @@
+Fix :class:`zoneinfo.ZoneInfo` on Windows accepting keys in which a component
+after a ``/`` starts with a drive letter, such as ``America/C:\file``.  Such a
+key could open a file outside the ``tzdata`` package; it now raises
+:exc:`ValueError`.