@miller-tech/uap 1.64.0 → 1.64.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
Binary file
|
|
@@ -80,6 +80,14 @@ def _inside(target: Path, roots: list[Path]) -> bool:
|
|
|
80
80
|
return False
|
|
81
81
|
|
|
82
82
|
|
|
83
|
+
def _is_dev_node(p: Path) -> bool:
|
|
84
|
+
"""True for device pseudo-files under /dev (/dev/null, /dev/stderr,
|
|
85
|
+
/dev/stdout, /dev/fd/N, /dev/tty, /dev/zero, ...). Redirecting or writing
|
|
86
|
+
to these never escapes the project workspace — it's universal shell idiom
|
|
87
|
+
(`2>/dev/null`, `>/dev/stdout`) — so they are always in scope."""
|
|
88
|
+
return p == Path("/dev") or str(p).startswith("/dev/")
|
|
89
|
+
|
|
90
|
+
|
|
83
91
|
def _check_path(target: str, roots: list[Path]) -> str:
|
|
84
92
|
"""Return the offending absolute path if out of scope, else ''."""
|
|
85
93
|
if not target:
|
|
@@ -88,6 +96,9 @@ def _check_path(target: str, roots: list[Path]) -> str:
|
|
|
88
96
|
if not p.is_absolute():
|
|
89
97
|
# Relative paths resolve under the enforcer cwd (the project root).
|
|
90
98
|
return ""
|
|
99
|
+
if _is_dev_node(p):
|
|
100
|
+
# /dev device nodes are not a filesystem escape (e.g. `2>/dev/null`).
|
|
101
|
+
return ""
|
|
91
102
|
return "" if _inside(p, roots) else str(p)
|
|
92
103
|
|
|
93
104
|
|