Fall back to an NTFS junction when the symlink escape test can't create a symlink (#3609)

Author: maxisbey

tests/shared/test_path_security.py

@@ -1,5 +1,6 @@
 """Tests for filesystem path safety primitives."""
 
+import sys
 from pathlib import Path
 
 import pytest
@@ -142,7 +143,14 @@ def test_safe_join_rejects_symlink_escape(tmp_path: Path):
     outside.mkdir()
     sandbox = tmp_path / "sandbox"
     sandbox.mkdir()
-    (sandbox / "escape").symlink_to(outside)
+    try:
+        (sandbox / "escape").symlink_to(outside)
+    except OSError as exc:  # pragma: lax no cover
+        if sys.platform != "win32" or exc.winerror != 1314:  # ERROR_PRIVILEGE_NOT_HELD; a junction needs no privilege
+            raise
+        import _winapi
+
+        _winapi.CreateJunction(str(outside), str(sandbox / "escape"))
 
     with pytest.raises(PathEscapeError, match="escapes base"):
         safe_join(sandbox, "escape", "secret.txt")