@mseep/open-computer-use 1.0.0

package/tests/patches/test_fix_skip_embedding_chat_files.py

@@ -0,0 +1,160 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for fix_skip_embedding_chat_files.py against v0.9.1 and v0.9.2 retrieval.py fixtures."""
+import ast
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+PATCH_DIR = REPO_ROOT / "openwebui" / "patches"
+sys.path.insert(0, str(Path(__file__).parent))
+from conftest import load_retrieval_v091, load_retrieval_v092  # noqa: E402
+
+
+def _run_patch(patch_name: str, target_file: Path) -> subprocess.CompletedProcess:
+    env = {**os.environ, "_PATCH_TARGET_OVERRIDE": str(target_file)}
+    return subprocess.run(
+        [sys.executable, str(PATCH_DIR / f"{patch_name}.py")],
+        env=env, capture_output=True, text=True, timeout=30,
+    )
+
+
+class TestFixSkipEmbeddingChatFiles(unittest.TestCase):
+    PATCH_NAME = "fix_skip_embedding_chat_files"
+    NEW_MARKER = "FIX_SKIP_EMBEDDING_CHAT_FILES"
+    PRIMARY_ANCHOR = "                collection_name = f'file-{file.id}'"
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self.target = Path(self.tmp) / "retrieval.py"
+        self.target.write_text(load_retrieval_v091(), encoding="utf-8")
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_fresh_apply(self):
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 0, f"stderr={r.stderr}")
+        self.assertIn(f"PATCHED: {self.PATCH_NAME}", r.stdout)
+        content = self.target.read_text()
+        self.assertIn(self.NEW_MARKER, content)
+        ast.parse(content)
+
+    def test_idempotent_rerun(self):
+        r1 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r1.returncode, 0)
+        after_first = self.target.read_text()
+        r2 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r2.returncode, 0)
+        self.assertIn("ALREADY PATCHED", r2.stdout)
+        self.assertEqual(after_first, self.target.read_text())
+
+    def test_broken_fixture_fails_loud(self):
+        content = self.target.read_text()
+        self.assertIn(self.PRIMARY_ANCHOR, content)
+        self.target.write_text(
+            content.replace(self.PRIMARY_ANCHOR, "                # ANCHOR_REMOVED_FOR_TEST")
+        )
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 1, f"stdout={r.stdout} stderr={r.stderr}")
+        self.assertIn("ERROR:", r.stderr)
+        self.assertIn(self.PATCH_NAME, r.stderr)
+
+
+class TestFixSkipEmbeddingChatFilesV092(unittest.TestCase):
+    """3-state coverage against real v0.9.2 retrieval.py fixture."""
+
+    PATCH_NAME = "fix_skip_embedding_chat_files"
+    NEW_MARKER = "FIX_SKIP_EMBEDDING_CHAT_FILES"
+    PRIMARY_ANCHOR = "                collection_name = f'file-{file.id}'"
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self.target = Path(self.tmp) / "retrieval.py"
+        self.target.write_text(load_retrieval_v092(), encoding="utf-8")
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_fresh_apply_v092(self):
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 0, f"stderr={r.stderr}")
+        self.assertIn(f"PATCHED: {self.PATCH_NAME}", r.stdout)
+        content = self.target.read_text()
+        self.assertIn(self.NEW_MARKER, content)
+        ast.parse(content)
+
+    def test_idempotent_rerun_v092(self):
+        r1 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r1.returncode, 0)
+        after_first = self.target.read_text()
+        r2 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r2.returncode, 0)
+        self.assertIn("ALREADY PATCHED", r2.stdout)
+        self.assertEqual(after_first, self.target.read_text())
+
+    def test_broken_fixture_fails_loud_v092(self):
+        content = self.target.read_text()
+        self.assertIn(self.PRIMARY_ANCHOR, content)
+        self.target.write_text(
+            content.replace(self.PRIMARY_ANCHOR, "                # ANCHOR_REMOVED_FOR_TEST")
+        )
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 1, f"stdout={r.stdout} stderr={r.stderr}")
+        self.assertIn("ERROR:", r.stderr)
+        self.assertIn(self.PATCH_NAME, r.stderr)
+
+    def test_patched_call_uses_await_v092(self):
+        # Regression guard for issue #96: Files.update_file_data_by_id was
+        # sync in v0.8.x, async since v0.9.x. process_file() is async, so the
+        # patched call must be awaited — otherwise the coroutine is dropped,
+        # the DB status stays 'pending', and the frontend spinner hangs.
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 0, f"stderr={r.stderr}")
+        content = self.target.read_text()
+        self.assertIn("await Files.update_file_data_by_id(", content)
+        self.assertNotRegex(
+            content,
+            r"(?<!await )Files\.update_file_data_by_id\(",
+            "Found a non-awaited Files.update_file_data_by_id call; "
+            "this regresses issue #96.",
+        )
+
+    def test_patched_kb_fallback_does_not_block_event_loop_v092(self):
+        # Storage.get_file and Loader.load are sync; calling them directly in
+        # the async process_file handler would block the OWUI event loop for
+        # the entire read/parse (minutes for large PDFs). Upstream OWUI
+        # offloads via asyncio.to_thread / Loader.aload; the KB fallback
+        # injected by this patch must do the same.
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 0, f"stderr={r.stderr}")
+        content = self.target.read_text()
+        # Locate the inserted KB fallback block by its marker comment.
+        marker = "KB fallback: extracting content from"
+        self.assertIn(marker, content)
+        block_start = content.index(marker)
+        # Bound the block to the next non-indented line to scope assertions.
+        block = content[block_start:block_start + 4000]
+        self.assertIn("await asyncio.to_thread(Storage.get_file", block)
+        self.assertIn("await _fb_loader.aload(", block)
+        self.assertNotRegex(
+            block,
+            r"(?<!to_thread\()Storage\.get_file\(",
+            "KB fallback calls Storage.get_file without asyncio.to_thread; "
+            "this blocks the OWUI event loop on storage I/O.",
+        )
+        self.assertNotRegex(
+            block,
+            r"(?<!await )_fb_loader\.load\(",
+            "KB fallback calls _fb_loader.load() synchronously; "
+            "use aload() to keep the event loop responsive.",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/patches/test_fix_skip_rag_files_native_fc.py

@@ -0,0 +1,120 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for fix_skip_rag_files_native_fc.py against v0.9.1 middleware.py."""
+import ast
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+PATCH_DIR = REPO_ROOT / "openwebui" / "patches"
+sys.path.insert(0, str(Path(__file__).parent))
+from conftest import load_middleware_v091, load_middleware_v092  # noqa: E402
+
+
+def _run_patch(patch_name: str, target_file: Path) -> subprocess.CompletedProcess:
+    env = {**os.environ, "_PATCH_TARGET_OVERRIDE": str(target_file)}
+    return subprocess.run(
+        [sys.executable, str(PATCH_DIR / f"{patch_name}.py")],
+        env=env, capture_output=True, text=True, timeout=30,
+    )
+
+
+class TestFixSkipRagFilesNativeFc(unittest.TestCase):
+    PATCH_NAME = "fix_skip_rag_files_native_fc"
+    NEW_MARKER = "FIX_SKIP_RAG_FILES_NATIVE_FC"
+    PRIMARY_ANCHOR = (
+        "            form_data, flags = await chat_completion_files_handler("
+        "request, form_data, extra_params, user)"
+    )
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self.target = Path(self.tmp) / "middleware.py"
+        self.target.write_text(load_middleware_v091(), encoding="utf-8")
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_fresh_apply(self):
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 0, f"stderr={r.stderr}")
+        self.assertIn(f"PATCHED: {self.PATCH_NAME}", r.stdout)
+        content = self.target.read_text()
+        self.assertIn(self.NEW_MARKER, content)
+        ast.parse(content)
+
+    def test_idempotent_rerun(self):
+        r1 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r1.returncode, 0)
+        after_first = self.target.read_text()
+        r2 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r2.returncode, 0)
+        self.assertIn("ALREADY PATCHED", r2.stdout)
+        self.assertEqual(after_first, self.target.read_text())
+
+    def test_broken_fixture_fails_loud(self):
+        content = self.target.read_text()
+        self.assertIn(self.PRIMARY_ANCHOR, content)
+        self.target.write_text(
+            content.replace(self.PRIMARY_ANCHOR, "            # ANCHOR_REMOVED_FOR_TEST")
+        )
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 1, f"stdout={r.stdout} stderr={r.stderr}")
+        self.assertIn("ERROR:", r.stderr)
+        self.assertIn(self.PATCH_NAME, r.stderr)
+
+
+class TestFixSkipRagFilesNativeFcV092(unittest.TestCase):
+    """3-state coverage against real v0.9.2 middleware.py fixture."""
+
+    PATCH_NAME = "fix_skip_rag_files_native_fc"
+    NEW_MARKER = "FIX_SKIP_RAG_FILES_NATIVE_FC"
+    PRIMARY_ANCHOR = (
+        "            form_data, flags = await chat_completion_files_handler("
+        "request, form_data, extra_params, user)"
+    )
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self.target = Path(self.tmp) / "middleware.py"
+        self.target.write_text(load_middleware_v092(), encoding="utf-8")
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_fresh_apply_v092(self):
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 0, f"stderr={r.stderr}")
+        self.assertIn(f"PATCHED: {self.PATCH_NAME}", r.stdout)
+        content = self.target.read_text()
+        self.assertIn(self.NEW_MARKER, content)
+        ast.parse(content)
+
+    def test_idempotent_rerun_v092(self):
+        r1 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r1.returncode, 0)
+        after_first = self.target.read_text()
+        r2 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r2.returncode, 0)
+        self.assertIn("ALREADY PATCHED", r2.stdout)
+        self.assertEqual(after_first, self.target.read_text())
+
+    def test_broken_fixture_fails_loud_v092(self):
+        content = self.target.read_text()
+        self.assertIn(self.PRIMARY_ANCHOR, content)
+        self.target.write_text(
+            content.replace(self.PRIMARY_ANCHOR, "            # ANCHOR_REMOVED_FOR_TEST")
+        )
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 1, f"stdout={r.stdout} stderr={r.stderr}")
+        self.assertIn("ERROR:", r.stderr)
+        self.assertIn(self.PATCH_NAME, r.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/patches/test_fix_tool_loop_errors.py

@@ -0,0 +1,128 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for fix_tool_loop_errors.py against v0.9.1 middleware.py.
+
+3-state coverage: fresh apply / idempotent re-run / broken fixture fails loud.
+"""
+import ast
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+PATCH_DIR = REPO_ROOT / "openwebui" / "patches"
+sys.path.insert(0, str(Path(__file__).parent))
+from conftest import load_middleware_v091, load_middleware_v092  # noqa: E402
+
+
+def _run_patch(patch_name: str, target_file: Path) -> subprocess.CompletedProcess:
+    env = {**os.environ, "_PATCH_TARGET_OVERRIDE": str(target_file)}
+    return subprocess.run(
+        [sys.executable, str(PATCH_DIR / f"{patch_name}.py")],
+        env=env, capture_output=True, text=True, timeout=30,
+    )
+
+
+class TestFixToolLoopErrors(unittest.TestCase):
+    PATCH_NAME = "fix_tool_loop_errors"
+    NEW_MARKER = "FIX_TOOL_LOOP_ERRORS"
+    # Distinctive single line from SEARCH_TOOL_LOOP / SEARCH_ITER anchors
+    PRIMARY_ANCHOR = (
+        "                while len(tool_calls) > 0 and tool_call_retries < "
+        "CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES:"
+    )
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self.target = Path(self.tmp) / "middleware.py"
+        self.target.write_text(load_middleware_v091(), encoding="utf-8")
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_fresh_apply(self):
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 0, f"stderr={r.stderr}\nstdout={r.stdout}")
+        self.assertIn(f"PATCHED: {self.PATCH_NAME}", r.stdout)
+        content = self.target.read_text()
+        self.assertIn(self.NEW_MARKER, content)
+        self.assertIn("TOOL_LOOP_ERRORS_UNIFIED", content)
+        ast.parse(content)
+
+    def test_idempotent_rerun(self):
+        r1 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r1.returncode, 0)
+        after_first = self.target.read_text()
+        r2 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r2.returncode, 0)
+        self.assertIn("ALREADY PATCHED", r2.stdout)
+        self.assertEqual(after_first, self.target.read_text())
+
+    def test_broken_fixture_fails_loud(self):
+        content = self.target.read_text()
+        self.assertIn(self.PRIMARY_ANCHOR, content, "test fixture assumption wrong")
+        self.target.write_text(
+            content.replace(self.PRIMARY_ANCHOR, "                # ANCHOR_REMOVED_FOR_TEST")
+        )
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 1, f"expected exit 1; stdout={r.stdout} stderr={r.stderr}")
+        self.assertIn("ERROR:", r.stderr)
+        self.assertIn(self.PATCH_NAME, r.stderr)
+
+
+class TestFixToolLoopErrorsV092(unittest.TestCase):
+    """3-state coverage against real v0.9.2 middleware.py fixture."""
+
+    PATCH_NAME = "fix_tool_loop_errors"
+    NEW_MARKER = "FIX_TOOL_LOOP_ERRORS"
+    PRIMARY_ANCHOR = (
+        "                while len(tool_calls) > 0 and tool_call_retries < "
+        "CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES:"
+    )
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self.target = Path(self.tmp) / "middleware.py"
+        self.target.write_text(load_middleware_v092(), encoding="utf-8")
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_fresh_apply_v092(self):
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 0, f"stderr={r.stderr}\nstdout={r.stdout}")
+        self.assertIn(f"PATCHED: {self.PATCH_NAME}", r.stdout)
+        content = self.target.read_text()
+        self.assertIn(self.NEW_MARKER, content)
+        self.assertIn("TOOL_LOOP_ERRORS_UNIFIED", content)
+        # v0.9.2 specific: the new 'metadata': metadata, key is emitted
+        self.assertIn("'metadata': metadata,", content)
+        ast.parse(content)
+
+    def test_idempotent_rerun_v092(self):
+        r1 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r1.returncode, 0)
+        after_first = self.target.read_text()
+        r2 = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r2.returncode, 0)
+        self.assertIn("ALREADY PATCHED", r2.stdout)
+        self.assertEqual(after_first, self.target.read_text())
+
+    def test_broken_fixture_fails_loud_v092(self):
+        content = self.target.read_text()
+        self.assertIn(self.PRIMARY_ANCHOR, content, "test fixture assumption wrong")
+        self.target.write_text(
+            content.replace(self.PRIMARY_ANCHOR, "                # ANCHOR_REMOVED_FOR_TEST")
+        )
+        r = _run_patch(self.PATCH_NAME, self.target)
+        self.assertEqual(r.returncode, 1, f"expected exit 1; stdout={r.stdout} stderr={r.stderr}")
+        self.assertIn("ERROR:", r.stderr)
+        self.assertIn(self.PATCH_NAME, r.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/security/test_path_traversal_app.py

@@ -0,0 +1,132 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for path traversal protection in computer-use-server/app.py endpoints.
+
+Note: FastAPI/Starlette normalizes `..` in URL paths at the HTTP level,
+so path traversal via `../../` in URL segments is blocked before reaching handlers.
+These tests verify that:
+1. sanitize_chat_id() rejects malicious chat_id values
+2. safe_path() provides defense-in-depth at the application level
+3. Normal operations continue to work correctly
+"""
+import sys
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent / "computer-use-server"))
+
+from fastapi.testclient import TestClient
+
+
+VALID_CHAT_ID = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+
+
+@pytest.fixture
+def tmp_data(tmp_path):
+    """Create temporary data directory with test files."""
+    chat_dir = tmp_path / VALID_CHAT_ID
+    outputs = chat_dir / "outputs"
+    uploads = chat_dir / "uploads"
+    outputs.mkdir(parents=True)
+    uploads.mkdir(parents=True)
+    (outputs / "test.txt").write_text("hello")
+    (uploads / "uploaded.txt").write_text("world")
+    return tmp_path
+
+
+@pytest.fixture
+def client(tmp_data):
+    """TestClient with patched BASE_DATA_DIR."""
+    import app as app_module
+    with patch.object(app_module, "BASE_DATA_DIR", tmp_data):
+        yield TestClient(app_module.app)
+
+
+class TestChatIdValidation:
+    """Test that endpoints reject malicious chat_id values."""
+
+    def test_upload_rejects_dot_dot_chat_id(self, client):
+        resp = client.post(
+            "/api/uploads/..test../file.txt",
+            files={"file": ("test.txt", b"content")},
+        )
+        assert resp.status_code == 400
+
+    def test_download_rejects_dot_dot_chat_id(self, client):
+        resp = client.get("/files/..test../somefile")
+        assert resp.status_code == 400
+
+    def test_archive_rejects_dot_dot_chat_id(self, client):
+        resp = client.get("/files/..test../archive")
+        assert resp.status_code == 400
+
+    def test_outputs_rejects_dot_dot_chat_id(self, client):
+        resp = client.get("/api/outputs/..test..")
+        assert resp.status_code == 400
+
+    def test_manifest_rejects_dot_dot_chat_id(self, client):
+        resp = client.get("/api/uploads/..test../manifest")
+        assert resp.status_code == 400
+
+    def test_uploads_list_rejects_dot_dot_chat_id(self, client):
+        resp = client.get("/api/uploads/..test../list")
+        assert resp.status_code == 400
+
+
+class TestNormalOperations:
+    """Test that legitimate operations continue to work."""
+
+    def test_upload_normal(self, client):
+        resp = client.post(
+            f"/api/uploads/{VALID_CHAT_ID}/newfile.txt",
+            files={"file": ("newfile.txt", b"content")},
+        )
+        assert resp.status_code == 200
+
+    def test_download_normal(self, client):
+        resp = client.get(f"/files/{VALID_CHAT_ID}/test.txt")
+        assert resp.status_code == 200
+        assert resp.text == "hello"
+
+    def test_archive_normal(self, client):
+        resp = client.get(f"/files/{VALID_CHAT_ID}/archive")
+        assert resp.status_code == 200
+        assert resp.headers["content-type"] == "application/zip"
+
+    def test_outputs_normal(self, client):
+        resp = client.get(f"/api/outputs/{VALID_CHAT_ID}")
+        assert resp.status_code == 200
+
+    def test_manifest_normal(self, client):
+        resp = client.get(f"/api/uploads/{VALID_CHAT_ID}/manifest")
+        assert resp.status_code == 200
+
+    def test_uploads_list_normal(self, client):
+        resp = client.get(f"/api/uploads/{VALID_CHAT_ID}/list")
+        assert resp.status_code == 200
+
+    def test_default_chat_id(self, client, tmp_data):
+        """chat_id='default' should be accepted."""
+        (tmp_data / "default" / "outputs").mkdir(parents=True)
+        resp = client.get("/api/outputs/default")
+        assert resp.status_code == 200
+
+
+class TestSafePathDirectly:
+    """Direct unit tests for safe_path integration — defense-in-depth."""
+
+    def test_safe_path_blocks_traversal(self, tmp_data):
+        from security import safe_path
+        from fastapi import HTTPException
+        base = tmp_data / VALID_CHAT_ID / "outputs"
+        with pytest.raises(HTTPException) as exc:
+            safe_path(base, "../../etc/passwd")
+        assert exc.value.status_code == 403
+
+    def test_safe_path_allows_subdirs(self, tmp_data):
+        from security import safe_path
+        base = tmp_data / VALID_CHAT_ID / "outputs"
+        result = safe_path(base, "subdir/file.txt")
+        assert str(result).startswith(str(base.resolve()))

package/tests/security/test_path_traversal_docker.py

@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for path traversal protection in docker_manager._get_meta_path."""
+import sys
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+from fastapi import HTTPException
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent / "computer-use-server"))
+
+import docker_manager
+
+
+VALID_CHAT_ID = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+
+
+class TestGetMetaPath:
+    def test_traversal_rejected(self, tmp_path):
+        with patch.object(docker_manager, "BASE_DATA_DIR", tmp_path):
+            with pytest.raises(HTTPException) as exc_info:
+                docker_manager._get_meta_path("../../etc")
+            assert exc_info.value.status_code == 400
+
+    def test_slash_rejected(self, tmp_path):
+        with patch.object(docker_manager, "BASE_DATA_DIR", tmp_path):
+            with pytest.raises(HTTPException) as exc_info:
+                docker_manager._get_meta_path("abc/def")
+            assert exc_info.value.status_code == 400
+
+    def test_normal_chat_id(self, tmp_path):
+        with patch.object(docker_manager, "BASE_DATA_DIR", tmp_path):
+            result = docker_manager._get_meta_path(VALID_CHAT_ID)
+            assert result == tmp_path / VALID_CHAT_ID / ".meta.json"
+            assert str(tmp_path) in str(result)

package/tests/security/test_path_traversal_settings.py

@@ -0,0 +1,87 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for path traversal protection in settings-wrapper/app.py."""
+import importlib
+import inspect
+import sys
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture
+def settings_client(tmp_path):
+    """TestClient with patched SKILLS_DIR and disabled auth."""
+    skills_dir = tmp_path / "skills"
+    skills_dir.mkdir()
+    (skills_dir / "valid-skill.zip").write_bytes(b"PK\x03\x04fake")
+
+    # Import settings-wrapper/app.py with a unique module name to avoid conflicts
+    settings_wrapper_path = Path(__file__).resolve().parent.parent.parent / "settings-wrapper"
+    spec = importlib.util.spec_from_file_location(
+        "settings_wrapper_app",
+        str(settings_wrapper_path / "app.py"),
+    )
+    settings_app = importlib.util.module_from_spec(spec)
+    sys.modules["settings_wrapper_app"] = settings_app
+    spec.loader.exec_module(settings_app)
+
+    with patch.object(settings_app, "SKILLS_DIR", skills_dir), \
+         patch.object(settings_app, "API_KEY", ""):
+        yield TestClient(settings_app.app)
+
+
+class TestDownloadSkillImplementation:
+    """Verify download_skill uses os.path pattern that CodeQL natively recognizes.
+
+    CodeQL py/path-injection does NOT recognize pathlib.Path.resolve() + is_relative_to()
+    as a containment check barrier. It DOES natively recognize os.path.realpath() +
+    startswith() when used in the same function scope.
+    """
+
+    def test_uses_os_path_realpath_not_is_relative_to(self, settings_client):
+        """download_skill must use os.path.realpath, not is_relative_to."""
+        settings_wrapper_path = Path(__file__).resolve().parent.parent.parent / "settings-wrapper"
+        spec = importlib.util.spec_from_file_location(
+            "_settings_wrapper_impl_check",
+            str(settings_wrapper_path / "app.py"),
+        )
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        source = inspect.getsource(mod.download_skill)
+        assert "is_relative_to" not in source, (
+            "download_skill uses is_relative_to() which CodeQL does not recognise "
+            "as a path containment sanitizer. Use os.path.realpath + startswith."
+        )
+        assert "os.path.realpath" in source, (
+            "download_skill must use os.path.realpath() for CodeQL to suppress "
+            "py/path-injection false positives."
+        )
+        assert "startswith" in source, (
+            "download_skill must use startswith() for the containment check."
+        )
+
+
+class TestDownloadSkillTraversal:
+    def test_dot_dot_in_name_rejected(self, settings_client):
+        """Skill name containing '..' should be rejected."""
+        resp = settings_client.get(
+            "/api/internal/skills/..evil../download"
+        )
+        assert resp.status_code == 400
+
+    def test_normal_skill(self, settings_client):
+        resp = settings_client.get(
+            "/api/internal/skills/valid-skill/download"
+        )
+        assert resp.status_code == 200
+
+    def test_native_skill(self, settings_client):
+        resp = settings_client.get(
+            "/api/internal/skills/nonexistent-skill/download"
+        )
+        assert resp.status_code == 200
+        assert resp.json()["type"] == "native"