Add additional check for project.license.file

[cdce8p]

Closes #724

[AA-Turner]

Perhaps? Although, normpath just does lexical manipulation and e.g. a/spam/../b might refer to a symlink.

Suggested change

	if ".." in license_f:
	if ".." in os.path.normpath(license_f):

[AA-Turner]

Or actually, as e.g. a file might be named a..b. I think backslashes are prohibited?

Suggested change

	if ".." in license_f:
	if ".." in license_f.split('/'):

[cdce8p]

Perhaps? Although, normpath just does lexical manipulation and e.g. a/spam/../b might refer to a symlink.

Technically, yes. Although I'm not sure it's worth the effort. Same for file names which contain ...
For the overwhelming majority, checking if ".." in license_f: to provide a better error message should be enough.

[takluyver]

Here's the check we do for paths in the sdist include/exclude lists:

flit/flit_core/flit_core/config.py

Lines 239 to 249 in 5f8c75f

	normp = osp.normpath(p)
	if isabs_ish(normp):
	raise ConfigError(
	f'{clude} pattern {p!r} is an absolute path'
	)
	if normp.startswith('..' + os.sep):
	raise ConfigError(
	'{} pattern {!r} points out of the directory containing pyproject.toml'
	.format(clude, p)
	)

I can't think of a use case for a path like foo/../bar (which will normalise to just bar), but it is currently allowed in that case. Whatever we do, I'd like it to be consistent across all the places where a relative path is specified.