Studio: expose Windows drive roots in the folder browser (#7082)
* Studio: expose Windows drive roots in the folder browser The model-selection folder browser bounds navigation to the roots returned by _build_browse_allowlist(), which exposed Linux removable-media mounts via linux_run_media_mount_roots() but had no Windows analog. As a result a user on C: could not browse to D:/E: to pick a model directory. Add windows_drive_roots(), a Windows-only companion to linux_run_media_mount_roots() that lists readable logical drive roots, and wire it into both browse-allowlist builders and their suggestion chips so other drives are both navigable and offered as quick-picks. The helper is a no-op on Linux/macOS, so existing platforms are unaffected. Closes #6368 * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: cover the Windows drive-root browse wiring with an integration test Add an allowlist integration test mirroring the Linux side's test_legacy_browse_allowlist_includes_linux_run_media_mounts: it extracts _build_browse_allowlist from routes/models.py, stubs external_media so windows_drive_roots() yields a fake drive root, and asserts that root becomes browsable through the built allowlist. Proves the wiring, not just the helper. * Studio: skip inactive drives via GetLogicalDrives before probing Resolve active logical drives from GetLogicalDrives() before probing each letter with os.path.isdir. Probing a drive letter mapped to a disconnected network share can otherwise block the async backend for tens of seconds per letter. The call degrades gracefully (falls back to probing all letters) when ctypes/windll is unavailable, so behavior is unchanged on Linux/macOS. Tests override the bitmask source to stay deterministic on real Windows hosts. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: allow browsing descendants of a drive-root allowlist entry routes/models.py _is_path_inside_allowlist() checked descendants with startswith(root_real + os.sep). A drive root ("D:\") already ends in a separator, so the prefix became "D:\\" and a child like "D:\models" was rejected with 403 after the browser opened the drive root. Only append a separator when the root does not already end in one. folder_browser.py already uses commonpath and was unaffected. Adds a regression test covering the separator-terminated-root descendant case. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: enforce the system-directory denylist during folder browsing Exposing whole Windows drive roots (and any legacy-registered filesystem root) widened the browse allowlist above system directories, but the browse resolvers only re-applied the credential/config denylist, not the _denied_path_prefixes() system-dir denylist that scan-folder registration enforces. That let browse-folders enumerate C:\Windows, C:\Program Files, /etc and /proc. - Add is_denied_system_path() to both storage modules and enforce it in both browse resolvers (legacy routes/models.py and hub folder_browser.py), on each resolved child and on the final target, keeping the /run/media carve-out. - Rework the legacy _is_path_inside_allowlist to use splitdrive + commonpath so a Windows drive root authorizes its descendants while a bare POSIX / does not, and to compare case-insensitively like the hub browser. - Reject the filesystem root in the legacy add_scan_folder, matching the hub. - Hide denied system dirs from browse listings and suggestion chips. - Add tests/test_browse_denylist.py and update the external-media path tests. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: make browse-denylist tests OS-portable The browse-time denylist tests used real /etc and tmp_path locations; on macOS tmp lives under the (legitimately denied) /private/var and /etc resolves to /private/etc, so three tests failed there. Pin the platform / use a tmp-based denied prefix so they assert the same behavior on Linux, macOS and Windows. * Studio: apply the bare POSIX-root guard to the hub folder browser too The _is_path_inside_allowlist guard that stops a legacy-registered '/' scan folder from authorizing every absolute path lived only in the legacy browser. The hub browser used commonpath without it, so a stale '/' row let it descend into /var, /root, /home -- which the system-directory denylist (/proc /sys /dev /etc /boot /run) does not cover, while the legacy browser blocked them. Mirror the legacy guard so both browsers treat '/' identically. Also resolve each directory entry before the denylist check in both listing loops, so a symlink or junction pointing into a denied dir is hidden instead of rendered as a row that 403s on descent. Adds legacy-vs-hub parity tests. * Studio: bound Windows drive probing so a disconnected mapping can't stall the browser GetLogicalDrives includes mapped network drives, so a disconnected but still mapped drive (e.g. Z: -> \\nas\share) stays set in the bitmask and reaches os.path.isdir, which can block for tens of seconds while Windows tries to reconnect. Because windows_drive_roots() runs synchronously while building both folder-browser responses, one stale mapping stalled every browse request. Probe each surviving drive in a daemon thread bounded by a short timeout and skip it if it does not answer in time, so a hung mapping is dropped instead of blocking the caller. Connected drives (local or network) still respond well within the timeout, so drive discovery is unchanged. Corrects the GetLogicalDrives docstring, which claimed the bitmask alone prevented the stall. * Studio: probe drive/media roots once per browse request, not twice Both folder browsers called windows_drive_roots() (and linux_run_media_mount_roots()) twice per browse request: once to seed the allowlist in _build_browse_allowlist() and again to build the suggestion chips. With the bounded drive probe, a disconnected mapped network drive then paid the timeout twice per folder click. Probe both once in the request handler and pass the results into _build_browse_allowlist(), reusing them for the chips, in both the legacy and hub browsers. Adds a test asserting the roots are reused, not re-probed. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: run the legacy browse endpoint in the threadpool, fix its stale test Two follow-ups from review of the drive-probe changes: - browse_folders was 'async def' but does only blocking filesystem I/O (the timeout-bounded drive probe, iterdir, realpath). On the event loop a disconnected mapped drive waiting out its probe timeout stalled every other request. Declare it sync 'def' so FastAPI runs it in the threadpool, matching the hub browse endpoint. No await was used in the body. - test_browse_folders_hides_sensitive_dirs monkeypatched _build_browse_allowlist with a zero-arg lambda; the once-per-request refactor now calls it with (media_roots, drive_roots), so the lambda raised TypeError. Accept and ignore the args. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: probe Windows drive roots concurrently so multiple dead mappings don't stack timeouts windows_drive_roots() probed each candidate serially, so N disconnected-but-mapped network drives each paid the full per-drive timeout in turn (e.g. four stale mappings added ~8s to every folder-browser request). Collect the candidate roots first, then probe them all at once under a single overall deadline, so the added delay stays at ~one timeout regardless of how many drives are disconnected. _readable_dir_within stays as a thin single-path wrapper for its existing callers/tests. * Studio: tighten comments in the folder-browser drive-root changes Condense the comments and docstrings added by the Windows drive-root and system-directory denylist work to be shorter and clearer while keeping the security and correctness rationale intact. Comment and docstring text only; no code changes. * Studio: iterate the input, not the results dict, when collecting readable drive probes _readable_dirs_within returned {path for path, ok in results.items()...}, but a probe thread that exceeded the join deadline is still alive and can insert its key into results during that iteration, raising 'dictionary changed size during iteration' -- reachable exactly in the disconnected-mapped-drive case the probe exists for. Iterate the fixed input list and read results.get(path) (an atomic read) instead. * Studio: keep the browse-route containment tests denylist-inert so they pass on macOS test_browse_folders_route.py exercises allowlist containment and the file-vs-directory guard, not the system-directory denylist. On macOS pytest tmp_path resolves under /private/var, a denied prefix, so _resolve_browse_target 403s the fixture dirs before the containment logic runs (4 failures). Add an autouse fixture that makes is_denied_system_path inert in this file; the denylist keeps its own coverage in test_browse_denylist.py. * Studio: keep the hub browse tests denylist-inert so they pass on macOS * Studio: register a UNC share root; only reject local filesystem roots * Studio: reject device drive roots and browse a registered UNC share root * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: treat device-namespace volume GUID roots as local filesystem roots --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: danielhanchen <danielhanchen@gmail.com>
This commit is contained in:
Gaurav Dubey
GitHub
parent
f9aa818ca8
commit
dc65638b7d
10 changed files with 1117 additions and 28 deletions
354
studio/backend/tests/test_windows_external_drive_paths.py
Normal file
354
studio/backend/tests/test_windows_external_drive_paths.py
Normal file
|
|
@ -0,0 +1,354 @@
|
|||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import ast
|
||||
import os
|
||||
import sys
|
||||
from pathlib import Path
|
||||
from types import SimpleNamespace
|
||||
from typing import Optional
|
||||
|
||||
from utils.paths import external_media
|
||||
|
||||
|
||||
_BACKEND_ROOT = Path(__file__).resolve().parent.parent
|
||||
|
||||
|
||||
class _HTTPException(Exception):
|
||||
def __init__(self, status_code: int, detail: str):
|
||||
super().__init__(detail)
|
||||
self.status_code = status_code
|
||||
self.detail = detail
|
||||
|
||||
|
||||
def _extract_routes_function(name: str, ns_extra: Optional[dict] = None) -> dict:
|
||||
"""Exec one top-level function from routes/models.py without importing the module (which pulls in FastAPI)."""
|
||||
tree = ast.parse((_BACKEND_ROOT / "routes" / "models.py").read_text(encoding = "utf-8"))
|
||||
fn = next(node for node in tree.body if isinstance(node, ast.FunctionDef) and node.name == name)
|
||||
module = ast.Module(body = [fn], type_ignores = [])
|
||||
ast.fix_missing_locations(module)
|
||||
ns = {"os": os, "Path": Path, "Optional": Optional}
|
||||
if ns_extra:
|
||||
ns.update(ns_extra)
|
||||
exec(compile(module, "<extracted routes/models.py>", "exec"), ns)
|
||||
return ns
|
||||
|
||||
|
||||
def _stub_windows(monkeypatch, existing_drives):
|
||||
"""Simulate Windows exposing only *existing_drives* (e.g. {"C", "D"}) as readable roots, independent of the host FS.
|
||||
|
||||
Overriding _active_windows_drive_bitmask keeps it deterministic even on a
|
||||
real Windows host, where live GetLogicalDrives would return the actual layout."""
|
||||
monkeypatch.setattr(external_media.platform, "system", lambda: "Windows")
|
||||
mask = sum(1 << (ord(d.upper()) - ord("A")) for d in existing_drives)
|
||||
monkeypatch.setattr(external_media, "_active_windows_drive_bitmask", lambda: mask)
|
||||
present = {f"{d.upper()}:\\" for d in existing_drives}
|
||||
monkeypatch.setattr(external_media.os.path, "isdir", lambda p: str(p) in present)
|
||||
monkeypatch.setattr(external_media.os, "access", lambda p, _mode: str(p) in present)
|
||||
|
||||
|
||||
def test_windows_drive_roots_empty_off_windows(monkeypatch):
|
||||
# Regression guard: the helper is a no-op on Linux/macOS so it can't change the allowlist on the platforms CI runs on.
|
||||
monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
|
||||
assert external_media.windows_drive_roots() == []
|
||||
monkeypatch.setattr(external_media.platform, "system", lambda: "Darwin")
|
||||
assert external_media.windows_drive_roots() == []
|
||||
|
||||
|
||||
def test_windows_drive_roots_lists_readable_drives(monkeypatch):
|
||||
_stub_windows(monkeypatch, {"C", "D", "E"})
|
||||
|
||||
roots = external_media.windows_drive_roots(drive_letters = "CDEF")
|
||||
|
||||
# F is absent, so it is skipped; the rest are exposed in order.
|
||||
assert roots == [Path("C:\\"), Path("D:\\"), Path("E:\\")]
|
||||
|
||||
|
||||
def test_windows_drive_roots_skips_absent_and_unreadable(monkeypatch):
|
||||
_stub_windows(monkeypatch, {"C"})
|
||||
|
||||
roots = external_media.windows_drive_roots(drive_letters = "CDE")
|
||||
|
||||
assert roots == [Path("C:\\")]
|
||||
|
||||
|
||||
def test_windows_drive_roots_ignores_bad_letters_and_dedupes(monkeypatch):
|
||||
_stub_windows(monkeypatch, {"C", "D"})
|
||||
|
||||
roots = external_media.windows_drive_roots(
|
||||
drive_letters = ["c:", "C", "D", "1", "AB", "", " d "],
|
||||
)
|
||||
|
||||
assert roots == [Path("C:\\"), Path("D:\\")]
|
||||
|
||||
|
||||
def test_readable_dir_within_times_out(monkeypatch):
|
||||
# A probe that outlives the timeout is reported not-readable, so a hung
|
||||
# (disconnected mapped network) drive is skipped instead of blocking.
|
||||
import time
|
||||
|
||||
monkeypatch.setattr(external_media.os.path, "isdir", lambda p: time.sleep(5) or True)
|
||||
monkeypatch.setattr(external_media.os, "access", lambda p, _mode: True)
|
||||
start = time.monotonic()
|
||||
ok = external_media._readable_dir_within("Z:\\", timeout = 0.2)
|
||||
elapsed = time.monotonic() - start
|
||||
assert ok is False
|
||||
assert elapsed < 3.0 # returned on the timeout, did not wait out the 5s stall
|
||||
|
||||
|
||||
def test_readable_dir_within_reports_fast_probe(monkeypatch):
|
||||
monkeypatch.setattr(external_media.os.path, "isdir", lambda p: True)
|
||||
monkeypatch.setattr(external_media.os, "access", lambda p, _mode: True)
|
||||
assert external_media._readable_dir_within("C:\\", timeout = 2.0) is True
|
||||
|
||||
|
||||
def test_windows_drive_roots_skips_hung_drive(monkeypatch):
|
||||
# A disconnected mapped drive stays set in the bitmask and its os.path.isdir
|
||||
# stalls; it must be skipped without stalling enumeration. C answers, D hangs,
|
||||
# so only C is listed, bounded by the per-drive timeout, not the stall.
|
||||
import time
|
||||
|
||||
monkeypatch.setattr(external_media.platform, "system", lambda: "Windows")
|
||||
monkeypatch.setattr(
|
||||
external_media,
|
||||
"_active_windows_drive_bitmask",
|
||||
lambda: sum(1 << (ord(d) - ord("A")) for d in "CD"),
|
||||
)
|
||||
monkeypatch.setattr(external_media, "_DRIVE_PROBE_TIMEOUT_S", 0.2)
|
||||
|
||||
def _isdir(p):
|
||||
if str(p) == "D:\\":
|
||||
time.sleep(5) # simulate the reconnect stall
|
||||
return True
|
||||
return str(p) == "C:\\"
|
||||
|
||||
monkeypatch.setattr(external_media.os.path, "isdir", _isdir)
|
||||
monkeypatch.setattr(external_media.os, "access", lambda p, _mode: True)
|
||||
|
||||
start = time.monotonic()
|
||||
roots = external_media.windows_drive_roots(drive_letters = "CD")
|
||||
elapsed = time.monotonic() - start
|
||||
|
||||
assert roots == [Path("C:\\")]
|
||||
assert elapsed < 3.0 # bounded by the per-drive timeout, not the 5s stall
|
||||
|
||||
|
||||
def test_windows_drive_roots_probes_hung_drives_in_parallel(monkeypatch):
|
||||
# Several disconnected mapped drives must add ~one timeout total, not one
|
||||
# per drive: C answers fast, D/E/F stall. The concurrent probe stays bounded
|
||||
# by a single deadline where serial probing would cost ~4x the timeout.
|
||||
import time
|
||||
|
||||
monkeypatch.setattr(external_media.platform, "system", lambda: "Windows")
|
||||
monkeypatch.setattr(
|
||||
external_media,
|
||||
"_active_windows_drive_bitmask",
|
||||
lambda: sum(1 << (ord(d) - ord("A")) for d in "CDEF"),
|
||||
)
|
||||
timeout = 0.2
|
||||
monkeypatch.setattr(external_media, "_DRIVE_PROBE_TIMEOUT_S", timeout)
|
||||
|
||||
def _isdir(p):
|
||||
if str(p) == "C:\\":
|
||||
return True
|
||||
time.sleep(5) # every other drive simulates a reconnect stall
|
||||
return True
|
||||
|
||||
monkeypatch.setattr(external_media.os.path, "isdir", _isdir)
|
||||
monkeypatch.setattr(external_media.os, "access", lambda p, _mode: True)
|
||||
|
||||
start = time.monotonic()
|
||||
roots = external_media.windows_drive_roots(drive_letters = "CDEF")
|
||||
elapsed = time.monotonic() - start
|
||||
|
||||
assert roots == [Path("C:\\")]
|
||||
# 3 stalled drives probed in parallel finish within ~1 timeout, well under the ~3*timeout a serial probe would take.
|
||||
assert elapsed < 3 * timeout
|
||||
|
||||
|
||||
def test_browse_allowlist_includes_windows_drive_roots(monkeypatch, tmp_path):
|
||||
# End-to-end wiring: windows_drive_roots() output flows into the browse
|
||||
# allowlist built by routes/models.py, mirroring the Linux media-mounts test.
|
||||
tree = ast.parse((_BACKEND_ROOT / "routes" / "models.py").read_text(encoding = "utf-8"))
|
||||
function_names = {
|
||||
"_build_browse_allowlist",
|
||||
"_browse_relative_parts",
|
||||
"_is_path_inside_allowlist",
|
||||
"_match_browse_child",
|
||||
"_normalize_browse_request_path",
|
||||
"_resolve_browse_target",
|
||||
}
|
||||
functions = [
|
||||
node
|
||||
for node in tree.body
|
||||
if isinstance(node, ast.FunctionDef) and node.name in function_names
|
||||
]
|
||||
module = ast.Module(body = functions, type_ignores = [])
|
||||
ast.fix_missing_locations(module)
|
||||
|
||||
home = tmp_path / "home"
|
||||
drive_root = tmp_path / "D_drive"
|
||||
model_dir = drive_root / "modelsAI" / "gguf"
|
||||
home.mkdir()
|
||||
model_dir.mkdir(parents = True)
|
||||
|
||||
fake_paths = SimpleNamespace(
|
||||
hf_default_cache_dir = lambda: tmp_path / "missing-default-hf",
|
||||
legacy_hf_cache_dir = lambda: tmp_path / "missing-legacy-hf",
|
||||
well_known_model_dirs = lambda: [],
|
||||
studio_root = lambda: tmp_path / "missing-studio",
|
||||
outputs_root = lambda: tmp_path / "missing-outputs",
|
||||
exports_root = lambda: tmp_path / "missing-exports",
|
||||
)
|
||||
fake_external_media = SimpleNamespace(
|
||||
linux_run_media_mount_roots = lambda: [],
|
||||
windows_drive_roots = lambda: [drive_root],
|
||||
)
|
||||
fake_studio_db = SimpleNamespace(
|
||||
list_scan_folders = lambda: [],
|
||||
contains_sensitive_path_component = lambda _p: False,
|
||||
# The simulated D:\ root maps to a tmp_path dir, not a denied system path.
|
||||
is_denied_system_path = lambda _p: False,
|
||||
)
|
||||
monkeypatch.setitem(sys.modules, "utils.paths", fake_paths)
|
||||
monkeypatch.setitem(sys.modules, "utils.paths.external_media", fake_external_media)
|
||||
monkeypatch.setitem(sys.modules, "storage.studio_db", fake_studio_db)
|
||||
|
||||
ns = {
|
||||
"HTTPException": _HTTPException,
|
||||
"os": os,
|
||||
"Path": Path,
|
||||
"Optional": Optional,
|
||||
"_safe_is_dir": lambda p: Path(p).is_dir(),
|
||||
"_resolve_hf_cache_dir": lambda: tmp_path / "missing-hf",
|
||||
"logger": SimpleNamespace(debug = lambda *_args, **_kwargs: None),
|
||||
}
|
||||
exec(compile(module, "<extracted routes/models.py>", "exec"), ns)
|
||||
|
||||
allowlist = ns["_build_browse_allowlist"]()
|
||||
|
||||
# The simulated Windows drive root is now browsable, and a model dir on it resolves.
|
||||
assert drive_root.resolve() in allowlist
|
||||
assert ns["_resolve_browse_target"](str(model_dir), allowlist) == model_dir.resolve()
|
||||
|
||||
|
||||
def test_build_browse_allowlist_reuses_passed_roots(monkeypatch, tmp_path):
|
||||
# Double-probe fix: a browse request probes the drive/media roots once and
|
||||
# passes them in, so _build_browse_allowlist must NOT scan
|
||||
# windows_drive_roots() again (a disconnected drive would double the stall).
|
||||
tree = ast.parse((_BACKEND_ROOT / "routes" / "models.py").read_text(encoding = "utf-8"))
|
||||
functions = [
|
||||
node
|
||||
for node in tree.body
|
||||
if isinstance(node, ast.FunctionDef) and node.name == "_build_browse_allowlist"
|
||||
]
|
||||
module = ast.Module(body = functions, type_ignores = [])
|
||||
ast.fix_missing_locations(module)
|
||||
|
||||
drive_root = tmp_path / "D_drive"
|
||||
drive_root.mkdir()
|
||||
|
||||
calls = {"drive": 0, "media": 0}
|
||||
|
||||
def _drive_roots():
|
||||
calls["drive"] += 1
|
||||
return [drive_root]
|
||||
|
||||
def _media_roots():
|
||||
calls["media"] += 1
|
||||
return []
|
||||
|
||||
fake_paths = SimpleNamespace(
|
||||
hf_default_cache_dir = lambda: tmp_path / "missing-default-hf",
|
||||
legacy_hf_cache_dir = lambda: tmp_path / "missing-legacy-hf",
|
||||
well_known_model_dirs = lambda: [],
|
||||
studio_root = lambda: tmp_path / "missing-studio",
|
||||
outputs_root = lambda: tmp_path / "missing-outputs",
|
||||
exports_root = lambda: tmp_path / "missing-exports",
|
||||
)
|
||||
fake_external_media = SimpleNamespace(
|
||||
linux_run_media_mount_roots = _media_roots,
|
||||
windows_drive_roots = _drive_roots,
|
||||
)
|
||||
fake_studio_db = SimpleNamespace(list_scan_folders = lambda: [])
|
||||
monkeypatch.setitem(sys.modules, "utils.paths", fake_paths)
|
||||
monkeypatch.setitem(sys.modules, "utils.paths.external_media", fake_external_media)
|
||||
monkeypatch.setitem(sys.modules, "storage.studio_db", fake_studio_db)
|
||||
|
||||
ns = {
|
||||
"os": os,
|
||||
"Path": Path,
|
||||
"Optional": Optional,
|
||||
"_safe_is_dir": lambda p: Path(p).is_dir(),
|
||||
"_resolve_hf_cache_dir": lambda: tmp_path / "missing-hf",
|
||||
"logger": SimpleNamespace(debug = lambda *_args, **_kwargs: None),
|
||||
}
|
||||
exec(compile(module, "<extracted routes/models.py>", "exec"), ns)
|
||||
build = ns["_build_browse_allowlist"]
|
||||
|
||||
# Roots passed in -> neither helper is probed, but the roots still flow in.
|
||||
allowlist = build([], [drive_root])
|
||||
assert calls == {"drive": 0, "media": 0}
|
||||
assert drive_root.resolve() in allowlist
|
||||
|
||||
# No args -> each helper is probed exactly once.
|
||||
build()
|
||||
assert calls == {"drive": 1, "media": 1}
|
||||
|
||||
|
||||
def test_is_path_inside_allowlist_real_descendants_and_siblings(tmp_path):
|
||||
# Component-wise containment (commonpath): a genuine descendant is allowed,
|
||||
# but a sibling sharing only a string prefix ("models_root_evil" vs
|
||||
# "models_root") is not, which the old startswith check could miss.
|
||||
ns = _extract_routes_function("_is_path_inside_allowlist")
|
||||
root = tmp_path / "models_root"
|
||||
child = root / "gguf" / "qwen"
|
||||
sibling = tmp_path / "models_root_evil"
|
||||
child.mkdir(parents = True)
|
||||
sibling.mkdir()
|
||||
|
||||
is_inside = ns["_is_path_inside_allowlist"]
|
||||
assert is_inside(root, [root]) is True # the root itself
|
||||
assert is_inside(child, [root]) is True # a genuine descendant
|
||||
assert is_inside(sibling, [root]) is False # prefix-collision sibling
|
||||
|
||||
|
||||
def test_is_path_inside_allowlist_posix_root_does_not_authorize_descendants(monkeypatch):
|
||||
# Regression for the reported POSIX "/" unlock: a bare filesystem root may
|
||||
# match itself but must NOT authorize arbitrary descendants such as /etc.
|
||||
ns = _extract_routes_function("_is_path_inside_allowlist")
|
||||
monkeypatch.setattr(os.path, "realpath", lambda p: str(p)) # keep "/" intact
|
||||
|
||||
is_inside = ns["_is_path_inside_allowlist"]
|
||||
assert is_inside("/", ["/"]) is True # the root itself
|
||||
assert is_inside("/etc", ["/"]) is False # not a licensed descendant
|
||||
assert is_inside("/root/models", ["/"]) is False
|
||||
|
||||
|
||||
def test_is_path_inside_allowlist_windows_drive_root_descendants():
|
||||
# Exercise the Windows drive-root branch on a POSIX host by backing os.path
|
||||
# with ntpath and an identity realpath (the simulated drives don't exist
|
||||
# here). A drive root authorizes its descendants; a different drive does not.
|
||||
import ntpath
|
||||
|
||||
win_os = SimpleNamespace(
|
||||
sep = "\\",
|
||||
path = SimpleNamespace(
|
||||
normcase = ntpath.normcase,
|
||||
realpath = lambda p: str(p),
|
||||
splitdrive = ntpath.splitdrive,
|
||||
dirname = ntpath.dirname,
|
||||
commonpath = ntpath.commonpath,
|
||||
),
|
||||
)
|
||||
ns = _extract_routes_function("_is_path_inside_allowlist", {"os": win_os})
|
||||
is_inside = ns["_is_path_inside_allowlist"]
|
||||
|
||||
assert is_inside("D:\\", ["D:\\"]) is True # drive root itself
|
||||
assert is_inside("D:\\models", ["D:\\"]) is True # descendant on the drive
|
||||
assert is_inside("D:\\models\\gguf", ["D:\\"]) is True # deeper descendant
|
||||
assert is_inside("d:\\models", ["D:\\"]) is True # case-insensitive drive letter
|
||||
assert is_inside("C:\\Users", ["D:\\"]) is False # different drive
|
||||
assert is_inside("D:\\models", ["E:\\"]) is False
|
||||
Loading…
Add table
Add a link
Reference in a new issue