# What is the correct interpretation of path-based PEP 508 URI\_reference?

**URL:** <https://discuss.python.org/t/what-is-the-correct-interpretation-of-path-based-pep-508-uri-reference/2815>\
**Category:** Packaging\
**Created:** [December 7, 2019, 2:54am UTC](https://discuss.python.org/t/what-is-the-correct-interpretation-of-path-based-pep-508-uri-reference/2815 "2019-12-07T02:54:27Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![chrahunt](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/chrahunt/32/947_2.png) [@chrahunt](https://discuss.python.org/u/chrahunt)\
**Post date:** [December 9, 2019, 5:47pm UTC](https://discuss.python.org/t/what-is-the-correct-interpretation-of-path-based-pep-508-uri-reference/2815/7 "2019-12-09T17:47:52Z")

</div>

> [@sbidoul](#):
>
> Are there security implications if we allow relative URLs to navigate up the root of the parent artifact?

If locking dependencies with specific hashes, which I assume security-conscious deployments are doing, then only artifacts matching the hashes would be installed. Does that mitigate the concern?

> [@sbidoul](#):
>
> Another interesting topic will be the behavior of `pip list` and `pip freeze` with relative URLs. I suppose it should make them absolute first?

Not just the behavior of `pip list` and `pip freeze`, but what should be stored in the `direct_url.json` in the first place. I made a comment [here](https://discuss.python.org/t/draft-pep-recording-the-origin-of-distributions-installed-from-direct-url-references/1535/34) with specific related questions.

---

_[View the full topic](https://discuss.python.org/t/what-is-the-correct-interpretation-of-path-based-pep-508-uri-reference/2815)._