Spaces:
Running
Running
Print the offending path in "is_relative_to" checks.
Browse files
lynxkite-app/src/lynxkite_app/crdt.py
CHANGED
@@ -34,7 +34,7 @@ class WorkspaceWebsocketServer(pycrdt_websocket.WebsocketServer):
|
|
34 |
"""
|
35 |
crdt_path = pathlib.Path(".crdt")
|
36 |
path = crdt_path / f"{name}.crdt"
|
37 |
-
assert path.is_relative_to(crdt_path)
|
38 |
ystore = pycrdt_websocket.ystore.FileYStore(path)
|
39 |
ydoc = pycrdt.Doc()
|
40 |
ydoc["workspace"] = ws = pycrdt.Map()
|
@@ -87,7 +87,7 @@ class CodeWebsocketServer(WorkspaceWebsocketServer):
|
|
87 |
"""Initialize a room for a text document with the given name."""
|
88 |
crdt_path = pathlib.Path(".crdt")
|
89 |
path = crdt_path / f"{name}.crdt"
|
90 |
-
assert path.is_relative_to(crdt_path)
|
91 |
ystore = pycrdt_websocket.ystore.FileYStore(path)
|
92 |
ydoc = pycrdt.Doc()
|
93 |
ydoc["text"] = text = pycrdt.Text()
|
@@ -261,7 +261,7 @@ async def execute(name: str, ws_crdt: pycrdt.Map, ws_pyd: workspace.Workspace, d
|
|
261 |
print(f"Running {name} in {ws_pyd.env}...")
|
262 |
cwd = pathlib.Path()
|
263 |
path = cwd / name
|
264 |
-
assert path.is_relative_to(cwd), "
|
265 |
# Save user changes before executing, in case the execution fails.
|
266 |
ws_pyd.save(path)
|
267 |
ops.load_user_scripts(name)
|
|
|
34 |
"""
|
35 |
crdt_path = pathlib.Path(".crdt")
|
36 |
path = crdt_path / f"{name}.crdt"
|
37 |
+
assert path.is_relative_to(crdt_path), f"Path '{path}' is invalid"
|
38 |
ystore = pycrdt_websocket.ystore.FileYStore(path)
|
39 |
ydoc = pycrdt.Doc()
|
40 |
ydoc["workspace"] = ws = pycrdt.Map()
|
|
|
87 |
"""Initialize a room for a text document with the given name."""
|
88 |
crdt_path = pathlib.Path(".crdt")
|
89 |
path = crdt_path / f"{name}.crdt"
|
90 |
+
assert path.is_relative_to(crdt_path), f"Path '{path}' is invalid"
|
91 |
ystore = pycrdt_websocket.ystore.FileYStore(path)
|
92 |
ydoc = pycrdt.Doc()
|
93 |
ydoc["text"] = text = pycrdt.Text()
|
|
|
261 |
print(f"Running {name} in {ws_pyd.env}...")
|
262 |
cwd = pathlib.Path()
|
263 |
path = cwd / name
|
264 |
+
assert path.is_relative_to(cwd), f"Path '{path}' is invalid"
|
265 |
# Save user changes before executing, in case the execution fails.
|
266 |
ws_pyd.save(path)
|
267 |
ops.load_user_scripts(name)
|
lynxkite-app/src/lynxkite_app/main.py
CHANGED
@@ -49,7 +49,7 @@ data_path = pathlib.Path()
|
|
49 |
|
50 |
def save(req: SaveRequest):
|
51 |
path = data_path / req.path
|
52 |
-
assert path.is_relative_to(data_path)
|
53 |
req.ws.save(path)
|
54 |
|
55 |
|
@@ -66,7 +66,7 @@ async def save_and_execute(req: SaveRequest):
|
|
66 |
async def delete_workspace(req: dict):
|
67 |
json_path: pathlib.Path = data_path / req["path"]
|
68 |
crdt_path: pathlib.Path = data_path / ".crdt" / f"{req['path']}.crdt"
|
69 |
-
assert json_path.is_relative_to(data_path)
|
70 |
json_path.unlink()
|
71 |
crdt_path.unlink()
|
72 |
|
@@ -74,7 +74,7 @@ async def delete_workspace(req: dict):
|
|
74 |
@app.get("/api/load")
|
75 |
def load(path: str):
|
76 |
path = data_path / path
|
77 |
-
assert path.is_relative_to(data_path)
|
78 |
if not path.exists():
|
79 |
return workspace.Workspace()
|
80 |
return workspace.Workspace.load(path)
|
@@ -97,7 +97,7 @@ def _get_path_type(path: pathlib.Path) -> str:
|
|
97 |
@app.get("/api/dir/list")
|
98 |
def list_dir(path: str):
|
99 |
path = data_path / path
|
100 |
-
assert path.is_relative_to(data_path)
|
101 |
return sorted(
|
102 |
[
|
103 |
DirectoryEntry(
|
@@ -114,7 +114,7 @@ def list_dir(path: str):
|
|
114 |
@app.post("/api/dir/mkdir")
|
115 |
def make_dir(req: dict):
|
116 |
path = data_path / req["path"]
|
117 |
-
assert path.is_relative_to(data_path)
|
118 |
assert not path.exists(), f"{path} already exists"
|
119 |
path.mkdir()
|
120 |
|
@@ -122,7 +122,9 @@ def make_dir(req: dict):
|
|
122 |
@app.post("/api/dir/delete")
|
123 |
def delete_dir(req: dict):
|
124 |
path: pathlib.Path = data_path / req["path"]
|
125 |
-
assert all([path.is_relative_to(data_path), path.exists(), path.is_dir()])
|
|
|
|
|
126 |
shutil.rmtree(path)
|
127 |
|
128 |
|
@@ -146,7 +148,7 @@ async def upload(req: fastapi.Request):
|
|
146 |
form = await req.form()
|
147 |
for file in form.values():
|
148 |
file_path = data_path / "uploads" / file.filename
|
149 |
-
assert file_path.is_relative_to(data_path), "
|
150 |
with file_path.open("wb") as buffer:
|
151 |
shutil.copyfileobj(file.file, buffer)
|
152 |
return {"status": "ok"}
|
|
|
49 |
|
50 |
def save(req: SaveRequest):
|
51 |
path = data_path / req.path
|
52 |
+
assert path.is_relative_to(data_path), f"Path '{path}' is invalid"
|
53 |
req.ws.save(path)
|
54 |
|
55 |
|
|
|
66 |
async def delete_workspace(req: dict):
|
67 |
json_path: pathlib.Path = data_path / req["path"]
|
68 |
crdt_path: pathlib.Path = data_path / ".crdt" / f"{req['path']}.crdt"
|
69 |
+
assert json_path.is_relative_to(data_path), f"Path '{json_path}' is invalid"
|
70 |
json_path.unlink()
|
71 |
crdt_path.unlink()
|
72 |
|
|
|
74 |
@app.get("/api/load")
|
75 |
def load(path: str):
|
76 |
path = data_path / path
|
77 |
+
assert path.is_relative_to(data_path), f"Path '{path}' is invalid"
|
78 |
if not path.exists():
|
79 |
return workspace.Workspace()
|
80 |
return workspace.Workspace.load(path)
|
|
|
97 |
@app.get("/api/dir/list")
|
98 |
def list_dir(path: str):
|
99 |
path = data_path / path
|
100 |
+
assert path.is_relative_to(data_path), f"Path '{path}' is invalid"
|
101 |
return sorted(
|
102 |
[
|
103 |
DirectoryEntry(
|
|
|
114 |
@app.post("/api/dir/mkdir")
|
115 |
def make_dir(req: dict):
|
116 |
path = data_path / req["path"]
|
117 |
+
assert path.is_relative_to(data_path), f"Path '{path}' is invalid"
|
118 |
assert not path.exists(), f"{path} already exists"
|
119 |
path.mkdir()
|
120 |
|
|
|
122 |
@app.post("/api/dir/delete")
|
123 |
def delete_dir(req: dict):
|
124 |
path: pathlib.Path = data_path / req["path"]
|
125 |
+
assert all([path.is_relative_to(data_path), path.exists(), path.is_dir()]), (
|
126 |
+
f"Path '{path}' is invalid"
|
127 |
+
)
|
128 |
shutil.rmtree(path)
|
129 |
|
130 |
|
|
|
148 |
form = await req.form()
|
149 |
for file in form.values():
|
150 |
file_path = data_path / "uploads" / file.filename
|
151 |
+
assert file_path.is_relative_to(data_path), f"Path '{file_path}' is invalid"
|
152 |
with file_path.open("wb") as buffer:
|
153 |
shutil.copyfileobj(file.file, buffer)
|
154 |
return {"status": "ok"}
|
lynxkite-core/src/lynxkite/core/ops.py
CHANGED
@@ -404,7 +404,7 @@ def load_user_scripts(workspace: str):
|
|
404 |
load_catalogs("plugins loaded")
|
405 |
cwd = pathlib.Path()
|
406 |
path = cwd / workspace
|
407 |
-
assert path.is_relative_to(cwd), "
|
408 |
for p in path.parents:
|
409 |
req = p / "requirements.txt"
|
410 |
if req.exists():
|
|
|
404 |
load_catalogs("plugins loaded")
|
405 |
cwd = pathlib.Path()
|
406 |
path = cwd / workspace
|
407 |
+
assert path.is_relative_to(cwd), f"Path '{path}' is invalid"
|
408 |
for p in path.parents:
|
409 |
req = p / "requirements.txt"
|
410 |
if req.exists():
|
lynxkite-graph-analytics/src/lynxkite_graph_analytics/ml_ops.py
CHANGED
@@ -20,7 +20,7 @@ op = ops.op_registration(core.ENV)
|
|
20 |
def load_ws(model_workspace: str):
|
21 |
cwd = pathlib.Path()
|
22 |
path = cwd / model_workspace
|
23 |
-
assert path.is_relative_to(cwd)
|
24 |
assert path.exists(), f"Workspace {path} does not exist"
|
25 |
ws = workspace.Workspace.load(path)
|
26 |
return ws
|
|
|
20 |
def load_ws(model_workspace: str):
|
21 |
cwd = pathlib.Path()
|
22 |
path = cwd / model_workspace
|
23 |
+
assert path.is_relative_to(cwd), f"Path '{path}' is invalid"
|
24 |
assert path.exists(), f"Workspace {path} does not exist"
|
25 |
ws = workspace.Workspace.load(path)
|
26 |
return ws
|