Werkzeug safe_join() allows Windows special device names

@@ -5,6 +5,9 @@ Version 3.1.4
 
 Unreleased
 
+-   ``safe_join`` on Windows does not allow special device names. This prevents
+    reading from these when using `send_from_directory`. ``secure_filename``
+    already prevented writing to these. :ghsa:`hgf8-39gv-g3f2`
 -   The debugger pin fails after 10 attempts instead of 11. :pr:`3020`
 -   The multipart form parser handles a ``\r\n`` sequence at a chunk boundary.
     :issue:`3065`

@@ -12,6 +12,14 @@
 _os_alt_seps: list[str] = list(
     sep for sep in [os.sep, os.path.altsep] if sep is not None and sep != "/"
 )
+_windows_device_files = {
+    "CON",
+    "PRN",
+    "AUX",
+    "NUL",
+    *(f"COM{i}" for i in range(10)),
+    *(f"LPT{i}" for i in range(10)),
+}
 
 
 def gen_salt(length: int) -> str:
@@ -139,6 +147,9 @@ def safe_join(directory: str, *pathnames: str) -> str | None:
     :param pathnames: The untrusted path components relative to the
         base directory.
     :return: A safe path, otherwise ``None``.
+
+    .. versionchanged:: 3.1.4
+        Special device names are disallowed on Windows.
     """
     if not directory:
         # Ensure we end up with ./path if directory="" is given,
@@ -153,6 +164,10 @@ def safe_join(directory: str, *pathnames: str) -> str | None:
 
         if (
             any(sep in filename for sep in _os_alt_seps)
+            or (
+                os.name == "nt"
+                and os.path.splitext(filename)[0].upper() in _windows_device_files
+            )
             or os.path.isabs(filename)
             # ntpath.isabs doesn't catch this on Python < 3.11
             or filename.startswith("/")

@@ -21,6 +21,7 @@
 from .datastructures import Headers
 from .exceptions import NotFound
 from .exceptions import RequestedRangeNotSatisfiable
+from .security import _windows_device_files
 from .security import safe_join
 from .wsgi import wrap_file
 
@@ -34,14 +35,6 @@
 
 _entity_re = re.compile(r"&([^;]+);")
 _filename_ascii_strip_re = re.compile(r"[^A-Za-z0-9_.-]")
-_windows_device_files = {
-    "CON",
-    "PRN",
-    "AUX",
-    "NUL",
-    *(f"COM{i}" for i in range(10)),
-    *(f"LPT{i}" for i in range(10)),
-}
 
 
 class cached_property(property, t.Generic[_T]):

@@ -70,3 +70,11 @@ def test_safe_join_os_sep():
 
 def test_safe_join_empty_trusted():
     assert safe_join("", "c:test.txt") == "./c:test.txt"
+
+
+def test_safe_join_windows_special(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Windows special device name is not allowed on Windows."""
+    monkeypatch.setattr("os.name", "nt")
+    assert safe_join("a", "CON") is None
+    monkeypatch.setattr("os.name", "posix")
+    assert safe_join("a", "CON") == "a/CON"