Rule to advise `os.path.commonprefix` is wrong and you should use `os.path.commonpath`

[notatallshaw]

Summary

commonprefix is a string comparison, not a path comparison:

commonprefix(['/usr/lib', '/usr/local/lib']) → '/usr/l' (string prefix; not a valid directory)
commonpath(['/usr/lib', '/usr/local/lib']) → '/usr' (valid path)

If a user is importing from os.path there is a 99.99% chance they want a path function not a string function.

commonpath was added in Python 3.5 to fix this odd commonprefix behavior: python/cpython#54604

[notatallshaw]

CPython issue by @sethmlarson to deprecate: python/cpython#144347

[notatallshaw]

Turns out there's an older CPython issue: python/cpython#74453

[amyreese]

~40k hits on github search for path.commonprefix. Not sure if there's a legitimate use for commonprefix, but I wouldn't want to see a violation for use of stdlib unless it's certain to be a bug.

[notatallshaw]

I'm not sure I understand whether you are for or against adding this as a rule?

I interpret that statistic as people are widely misinterpreting this function and it would be a very high value rule to reduce bugs in the wild.

[amyreese]

I think without further inspection of the general usage, I don't want to cast assumptions that all uses of it are defacto bad. I presume there is a use for it if it's in the stdlib, and the stdlib docs are clear about what its limitations are.

[sethmlarson]

The API is now deprecated in Python 3.15 due to its long history of being a security footgun.

[amyreese]

Sounds like it would be a great addition to the pyupgrade set of rules then, assuming we can coordinate with them upstream on a rule code. :)

[notatallshaw]

Pyupgrade is usually tied to specific versions of Python when a feature was depreciated, e.g. Python 3.15+.

But this is a footgun in any version of Python since it was first added (sometime in Python 1.x?) and should be replaced for commonpath for Python 3.5+.

I can put a more extensive case together showing this when I have some time.

[ntBre]

I'd be fine adding this as a RUF rule. I'm hopeful that distinct categories like UP are going to be less important as we start making progress on #1774 again.

[woodruffw]

Yeah, I think a RUF rule for this would be really great. @sethmlarson put together a post on some of the API's history (and history of misuse) here: https://sethmlarson.dev/deprecate-confusing-apis-like-os-path-commonprefix

(One of the small ironies here is that there's probably a ton of hits for commonprefix because of the Trellis spam campaign a few years ago.)

[MichaReiser]

@amyreese do you still have any concerns for adding this rule to RUF or can we mark this issue as accepted?

[amyreese]

No, it being deprecated in cpython is more than enough signal for me. :)