ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[pre-commit.ci] auto fixes from pre-commit.com hooks

Browse source 
for more information, see https://pre-commit.ci
This commit is contained in:
pre-commit-ci[bot] 2026-05-24 14:35:53 +00:00
commit b038848482
2 changed files with 19 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

21
studio/backend/core/inference/tools.py
View file

@ -1352,9 +1352,7 @@ def _check_signal_escape_patterns(code: str):
if alias.name == "join":
bare_path_join_aliases.add(alias.asname or "join")
elif alias.name == "expanduser":
bare_path_expanduser_aliases.add(
alias.asname or "expanduser"
)
bare_path_expanduser_aliases.add(alias.asname or "expanduser")
elif _node.module == "shutil":
for alias in _node.names:
if alias.name in _SHUTIL_COPY_NAMES:
@ -1364,9 +1362,7 @@ def _check_signal_escape_patterns(code: str):
elif _node.module == "pathlib":
for alias in _node.names:
if alias.name in _PATHLIB_PATH_CLASSES_PREPASS:
path_class_aliases_prepass.add(
alias.asname or alias.name
)
path_class_aliases_prepass.add(alias.asname or alias.name)
# Cheap hint set used to bias ``string_bindings`` toward the most
# sensitive value of a name when multiple literals are assigned.
@ -1658,9 +1654,7 @@ def _check_signal_escape_patterns(code: str):
"eval",
"exec",
):
eval_exec_aliases.setdefault(
_target.id, _assign.value.id
)
eval_exec_aliases.setdefault(_target.id, _assign.value.id)
elif isinstance(_target, (ast.Tuple, ast.List)) and isinstance(
_assign.value, (ast.Tuple, ast.List)
):
@ -3218,10 +3212,15 @@ def _check_signal_escape_patterns(code: str):
# shutil alias. The suffix-match guards against random
# ``something.copy(...)`` calls on unrelated objects.
_attr = node.func.attr
_recv_chain = fq[: -(len(_attr) + 1)] if _attr in _SHUTIL_COPY_NAMES else ""
_recv_chain = (
fq[: -(len(_attr) + 1)] if _attr in _SHUTIL_COPY_NAMES else ""
)
if _recv_chain in shutil_module_aliases and _attr in _SHUTIL_COPY_NAMES:
file_copy_fq = f"shutil.{_attr}"
elif isinstance(node.func, ast.Name) and node.func.id in bare_shutil_copy_aliases:
elif (
isinstance(node.func, ast.Name)
and node.func.id in bare_shutil_copy_aliases
):
file_copy_fq = bare_shutil_copy_aliases[node.func.id]
if file_copy_fq is not None:
# Use the canonical ``shutil.X`` name in the error

18
studio/backend/tests/test_sandbox_hardening.py
View file

@ -1801,9 +1801,9 @@ class TestR4_BraceCapOffByOne:
def test_brace_with_n_dummies_blocked(self, n_dummies):
dummies = ",".join(f"x{i}" for i in range(n_dummies))
cmd = f"cat /home/u/.aws/{{{dummies},credentials}}"
assert _find_sensitive_paths(cmd), (
f"brace bomb with {n_dummies} dummies leaked: {cmd!r}"
)
assert _find_sensitive_paths(
cmd
), f"brace bomb with {n_dummies} dummies leaked: {cmd!r}"
def test_brace_bomb_within_limit_blocked(self):
# 100 alts x 100 dummy chars per alt = comfortably under cap;
@ -1811,9 +1811,9 @@ class TestR4_BraceCapOffByOne:
# value names a sensitive path.
dummies = ",".join(f"x{i}" for i in range(500))
cmd = f"cat /home/u/.aws/{{{dummies},credentials}}"
assert _find_sensitive_paths(cmd), (
f"brace bomb (501 alts) within cap leaked: {cmd!r}"
)
assert _find_sensitive_paths(
cmd
), f"brace bomb (501 alts) within cap leaked: {cmd!r}"
class TestR4_ThreadSelfShellExpansion:
@ -1831,9 +1831,9 @@ class TestR4_ThreadSelfShellExpansion:
],
)
def test_thread_self_shell_expansion_blocked(self, cmd):
assert _find_sensitive_paths(cmd), (
f"thread-self shell expansion leaked: {cmd!r}"
)
assert _find_sensitive_paths(
cmd
), f"thread-self shell expansion leaked: {cmd!r}"
class TestR4_EvalExecPrepass: