From 9e4e9be8eb7b4cb1a6f682f46ec80a3ec055ac65 Mon Sep 17 00:00:00 2001
From: Cary Hawkins <hawkinscary23@gmail.com>
Date: Thu, 15 Oct 2026 14:03:28 -0700
Subject: [PATCH] [3.11] gh-159428: Don't read mimetypes.knownfiles by default
 on Windows (GH-159445)

Make knownfiles empty on Windows so that only the registry is used by default. Files passed to init() or assigned to knownfiles explicitly are still read.
(cherry picked from commit 04a29bf8f9ff8526cd96cb7368400173303a390a)

Co-authored-by: Cary Hawkins <hawkinscary23@gmail.com>
---
 Lib/mimetypes.py                              | 28 +++++++++++--------
 Lib/test/test_mimetypes.py                    |  7 +++++
 ...-10-15-03-47-08.gh-issue-159428.XHRKwY.rst |  2 ++
 3 files changed, 26 insertions(+), 11 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst

diff --git a/Lib/mimetypes.py b/Lib/mimetypes.py
index 4a6b00b216b6347..d610483738ec855 100644
--- a/Lib/mimetypes.py
+++ b/Lib/mimetypes.py
@@ -45,17 +45,23 @@
     "suffix_map", "encodings_map", "types_map", "common_types"
 ]
 
-knownfiles = [
-    "/etc/mime.types",
-    "/etc/httpd/mime.types",                    # Mac OS X
-    "/etc/httpd/conf/mime.types",               # Apache
-    "/etc/apache/mime.types",                   # Apache 1
-    "/etc/apache2/mime.types",                  # Apache 2
-    "/usr/local/etc/httpd/conf/mime.types",
-    "/usr/local/lib/netscape/mime.types",
-    "/usr/local/etc/httpd/conf/mime.types",     # Apache 1.2
-    "/usr/local/etc/mime.types",                # Apache 1.3
-    ]
+if sys.platform == "win32":
+    # The default paths would resolve to the root of the current drive on Windows
+    # (e.g. C:\etc\mime.types), which unprivileged users can usually create.
+    # Only the registry is used by default.
+    knownfiles = []
+else:
+    knownfiles = [
+        "/etc/mime.types",
+        "/etc/httpd/mime.types",                    # Mac OS X
+        "/etc/httpd/conf/mime.types",               # Apache
+        "/etc/apache/mime.types",                   # Apache 1
+        "/etc/apache2/mime.types",                  # Apache 2
+        "/usr/local/etc/httpd/conf/mime.types",
+        "/usr/local/lib/netscape/mime.types",
+        "/usr/local/etc/httpd/conf/mime.types",     # Apache 1.2
+        "/usr/local/etc/mime.types",                # Apache 1.3
+        ]
 
 inited = False
 _db = None
diff --git a/Lib/test/test_mimetypes.py b/Lib/test/test_mimetypes.py
index cc91d539d477fa3..2b531615c40ee09 100644
--- a/Lib/test/test_mimetypes.py
+++ b/Lib/test/test_mimetypes.py
@@ -51,6 +51,10 @@ def test_default_data(self):
         eq(self.db.guess_type("foo.tar.bz2"), ("application/x-tar", "bzip2"))
         eq(self.db.guess_type("foo.tar.xz"), ("application/x-tar", "xz"))
 
+    @unittest.skipIf(sys.platform == "win32", "non-Windows only")
+    def test_default_knownfiles(self):
+        self.assertIn("/etc/mime.types", knownfiles)
+
     def test_data_urls(self):
         eq = self.assertEqual
         guess_type = self.db.guess_type
@@ -288,6 +292,9 @@ def test_registry_parsing(self):
         eq(self.db.guess_type("image.jpg"), ("image/jpeg", None))
         eq(self.db.guess_type("image.png"), ("image/png", None))
 
+    def test_default_knownfiles(self):
+        self.assertEqual(knownfiles, [])
+
     @unittest.skipIf(not hasattr(_winapi, "_mimetypes_read_windows_registry"),
                      "read_windows_registry accelerator unavailable")
     def test_registry_accelerator(self):
diff --git a/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst b/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
new file mode 100644
index 000000000000000..d481ed2b74a20ea
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
@@ -0,0 +1,2 @@
+:mod:`mimetypes` no longer reads the files listed in :data:`mimetypes.knownfiles`
+by default on Windows, and uses only the registry.