Affected: nltk

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

Affected: PyPI: nltk

### Summary

There's a logic bug in `FileSystemPathPointer.open()` inside `nltk/data.py` that makes the sandbox check permanently inert. The guard condition is always `False` — meaning any file the process can read is accessible by passing a `file://` URL to `nltk.data.load()`.

---

### Details

In `nltk/data.py`, `FileSystemPathPointer.open()` was patched at some point with a comment saying "SECURITY PATCH ENFORCING SANDBOX", but the check doesn't work: ```python def open(self, encoding=None): path = os.path.normpath(self._path)

# Block raw absolute reads such as "/" "C:\\Windows" etc. if os.path.isabs(path) and path != os.path.normpath(self._path): raise ValueError(f"Direct absolute file access blocked: {path}")

stream = open(self._path, "rb") ```

`path` is set to `os.path.normpath(self._path)` on line 1, then compared against `os.path.normpath(self._path)` again in the condition. They are always equal. The `ValueError` never fires.

On top of that, `__init__` already calls `os.path.abspath()` before storing `self._path`, so it's normalized before `open()` is even called. Running `normpath` on it again changes nothing.

The `stream = open(self._path, "rb")` line is always reached regardless of what path was passed in.

---

### PoC

Tested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04. ```python import nltk from nltk.data import FileSystemPathPointer

# direct construction ptr = FileSystemPathPointer("/etc/passwd") with ptr.open() as f: print(f.r…

Affected: PyPI: nltk

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.