FlowerPower 0.30.0__py3-none-any.whl → 0.31.1__py3-none-any.whl

flowerpower/utils/security.py

@@ -0,0 +1,221 @@
+"""Security utilities for input validation and sanitization."""
+
+import os
+import re
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Union, TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+
+class SecurityError(Exception):
+    """Raised when security validation fails."""
+    pass
+
+
+def validate_file_path(path: Union[str, Path], 
+                      allowed_extensions: Optional[List[str]] = None,
+                      allow_absolute: bool = True,
+                      allow_relative: bool = True) -> Path:
+    """Validate and sanitize file paths to prevent directory traversal attacks.
+    
+    Args:
+        path: File path to validate
+        allowed_extensions: List of allowed file extensions (e.g., ['.yaml', '.yml'])
+        allow_absolute: Whether to allow absolute paths
+        allow_relative: Whether to allow relative paths
+        
+    Returns:
+        Validated Path object
+        
+    Raises:
+        SecurityError: If path is invalid or potentially dangerous
+        ValueError: If path is empty or None
+    """
+    if not path:
+        raise ValueError("Path cannot be empty or None")
+    
+    # Convert to Path object
+    path_obj = Path(path)
+    
+    # Check for directory traversal attempts
+    path_str = str(path_obj)
+    if '..' in path_obj.parts or path_str.startswith('..'):
+        raise SecurityError(f"Directory traversal detected in path: {path}")
+    
+    # Check absolute vs relative path restrictions
+    if path_obj.is_absolute() and not allow_absolute:
+        raise SecurityError(f"Absolute paths not allowed: {path}")
+    
+    if not path_obj.is_absolute() and not allow_relative:
+        raise SecurityError(f"Relative paths not allowed: {path}")
+    
+    # Validate file extension if specified
+    if allowed_extensions:
+        if not path_obj.suffix.lower() in [ext.lower() for ext in allowed_extensions]:
+            raise SecurityError(
+                f"File extension '{path_obj.suffix}' not allowed. "
+                f"Allowed: {allowed_extensions}"
+            )
+    
+    # Check for potentially dangerous characters
+    dangerous_chars = ['|', '&', ';', '`', '$', '<', '>', '"', "'"]
+    if any(char in path_str for char in dangerous_chars):
+        raise SecurityError(f"Dangerous characters detected in path: {path}")
+    
+    return path_obj
+
+
+def validate_pipeline_name(name: str) -> str:
+    """Validate pipeline name to prevent injection attacks.
+    
+    Args:
+        name: Pipeline name to validate
+        
+    Returns:
+        Validated name
+        
+    Raises:
+        ValueError: If name is invalid
+        SecurityError: If name contains dangerous characters
+    """
+    if not name or not isinstance(name, str):
+        raise ValueError("Pipeline name must be a non-empty string")
+    
+    name = name.strip()
+    if not name:
+        raise ValueError("Pipeline name cannot be empty or only whitespace")
+    
+    # Check for dangerous characters
+    if not re.match(r'^[a-zA-Z0-9_-]+$', name):
+        raise SecurityError(
+            f"Pipeline name '{name}' contains invalid characters. "
+            "Only alphanumeric, underscore, and hyphen are allowed."
+        )
+    
+    # Check length constraints
+    if len(name) > 100:
+        raise SecurityError(f"Pipeline name too long: {len(name)} > 100 characters")
+    
+    return name
+
+
+def validate_config_dict(config: Dict[str, Any], 
+                        allowed_keys: Optional[List[str]] = None,
+                        max_depth: int = 10) -> Dict[str, Any]:
+    """Validate configuration dictionary to prevent malicious content.
+    
+    Args:
+        config: Configuration dictionary to validate
+        allowed_keys: List of allowed top-level keys
+        max_depth: Maximum nesting depth to prevent DoS attacks
+        
+    Returns:
+        Validated configuration dictionary
+        
+    Raises:
+        SecurityError: If configuration contains dangerous content
+        ValueError: If configuration is invalid
+    """
+    if not isinstance(config, dict):
+        raise ValueError("Configuration must be a dictionary")
+    
+    # Check for allowed keys
+    if allowed_keys:
+        invalid_keys = set(config.keys()) - set(allowed_keys)
+        if invalid_keys:
+            raise SecurityError(f"Invalid configuration keys: {invalid_keys}")
+    
+    # Check nesting depth
+    def check_depth(obj, depth=0):
+        if depth > max_depth:
+            raise SecurityError(f"Configuration nesting too deep: {depth} > {max_depth}")
+        
+        if isinstance(obj, dict):
+            for value in obj.values():
+                check_depth(value, depth + 1)
+        elif isinstance(obj, (list, tuple)):
+            for item in obj:
+                check_depth(item, depth + 1)
+    
+    check_depth(config)
+    
+    return config
+
+
+def sanitize_log_data(data: Any) -> Any:
+    """Sanitize data for safe logging to prevent log injection.
+    
+    Args:
+        data: Data to sanitize for logging
+        
+    Returns:
+        Sanitized data safe for logging
+    """
+    if isinstance(data, str):
+        # Remove potential log injection characters
+        sanitized = re.sub(r'[\r\n\t]', ' ', data)
+        # Limit length to prevent log flooding
+        if len(sanitized) > 1000:
+            sanitized = sanitized[:997] + "..."
+        return sanitized
+    elif isinstance(data, (dict, list)):
+        # For complex objects, convert to string and sanitize
+        return sanitize_log_data(str(data))
+    else:
+        return data
+
+
+def validate_executor_type(executor_type: str) -> str:
+    """Validate executor type to prevent arbitrary code execution.
+    
+    Args:
+        executor_type: Executor type string to validate
+        
+    Returns:
+        Validated executor type
+        
+    Raises:
+        SecurityError: If executor type is invalid or dangerous
+    """
+    if not executor_type or not isinstance(executor_type, str):
+        raise ValueError("Executor type must be a non-empty string")
+    
+    allowed_executors = {
+        'synchronous', 'threadpool', 'processpool', 'ray', 'dask'
+    }
+    
+    if executor_type not in allowed_executors:
+        raise SecurityError(
+            f"Invalid executor type: {executor_type}. "
+            f"Allowed types: {allowed_executors}"
+        )
+    
+    return executor_type
+
+
+def validate_callback_function(callback: Any) -> bool:
+    """Validate callback function to ensure it's safe to execute.
+    
+    Args:
+        callback: Callback function or callable to validate
+        
+    Returns:
+        True if callback is valid
+        
+    Raises:
+        SecurityError: If callback is dangerous or invalid
+    """
+    if callback is None:
+        return True
+    
+    if not callable(callback):
+        raise SecurityError("Callback must be callable")
+    
+    # Check if it's a built-in function that could be dangerous
+    dangerous_functions = {'eval', 'exec', 'compile', '__import__'}
+    if hasattr(callback, '__name__') and callback.__name__ in dangerous_functions:
+        raise SecurityError(f"Dangerous callback function: {callback.__name__}")
+    
+    return True

{flowerpower-0.30.0.dist-info → flowerpower-0.31.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: FlowerPower
-Version: 0.30.0
+Version: 0.31.1
 Summary: A simple workflow framework for building and managing data processing pipelines
 Author-email: "Volker L." <ligno.blades@gmail.com>
 Project-URL: Homepage, https://github.com/legout/flowerpower
@@ -11,7 +11,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: duration-parser>=1.0.1
 Requires-Dist: fsspec>=2024.10.0
-Requires-Dist: fsspec-utils[full]>=0.1.0
+Requires-Dist: fsspec-utils>=0.1.0
 Requires-Dist: humanize>=4.12.2
 Requires-Dist: msgspec>=0.19.0
 Requires-Dist: munch>=4.0.0

flowerpower-0.31.1.dist-info/RECORD

@@ -0,0 +1,53 @@
+flowerpower/__init__.py,sha256=nHFrD6twJyR-Ti6Yn0lLcyXXcKOi0tFfOD96oAu17Js,431
+flowerpower/flowerpower.py,sha256=RCQFRvzZhuxmaIw8Q28lCb2XwArFmTNcUbHqxMcmRZk,21422
+flowerpower/cfg/__init__.py,sha256=bEvxYCjYGO5djgjiYmLMIMrrSB2uaEdA7LbcVOT_6Ow,13345
+flowerpower/cfg/base.py,sha256=-hYLxx7aoSvh_w_GRefPRicT3M5L3fTsUtCnhYDiQF8,9907
+flowerpower/cfg/exceptions.py,sha256=zUJabfUekr_BFLehv_v7SewPTUkC-nZ3vcbA7iB8ujc,1628
+flowerpower/cfg/pipeline/__init__.py,sha256=e9IMjpFBo61SiEg7aVH7AYyqwfZeSYn7YhoNdKvpUKE,13820
+flowerpower/cfg/pipeline/adapter.py,sha256=PGRo-4-Dorevh9HttVDmVNvyX1BWfNj_SQ5kcqYOXuA,2275
+flowerpower/cfg/pipeline/builder.py,sha256=drQv5j6fAygfVk3ShawuYQPZbfuNYYqbLoGdA8o6NCQ,13215
+flowerpower/cfg/pipeline/builder_adapter.py,sha256=UJRdZKkzAzklA-JtxpZ6Atp2oxWsoYY5mWejXykOvDQ,4526
+flowerpower/cfg/pipeline/builder_executor.py,sha256=GArx-PKTt3AujqrJE2ShvfZ5rIQu9oGPKhfDaddqsVY,3185
+flowerpower/cfg/pipeline/run.py,sha256=6a8tYuxjvTGiE6E7M7kd0fTAZtJyHUnWoRb_dIAXVMA,8488
+flowerpower/cfg/project/__init__.py,sha256=WJpjSV8N3e8xpBDAQawOZa--fflnQ0Efz_hl4hmV_p4,6311
+flowerpower/cfg/project/adapter.py,sha256=oI_LIs-DObJWNcb3W39h4OqrfgBajwA_QQtPA7Gi_Eo,1686
+flowerpower/cli/__init__.py,sha256=z0VqloACt6C1hHti1r-_ZP9XW4S4hxpJp2sR8wKErVw,5236
+flowerpower/cli/cfg.py,sha256=Ic8nXHm_myOx6uZgZAjs3OU8vWoZghdNG6pC1mdeM_M,67
+flowerpower/cli/pipeline.py,sha256=VjAHgtvhX9wFSGHmQ2hYpz3QCBoJwvUkJwJvza6nbvA,25585
+flowerpower/cli/utils.py,sha256=wBaPE_6VC8Bgoz_uxfeXBiVFpYY_1iQh-_GKqBuIQbI,6714
+flowerpower/pipeline/__init__.py,sha256=ltr4LQnM5Boa9w7t-lNVmmcSglIkTPuIoeYnEKWU4Og,122
+flowerpower/pipeline/base.py,sha256=oQSDfEAyY2_kDRlHNnHr6ihZvfGeOjyMJRPKob1i7U8,3560
+flowerpower/pipeline/config_manager.py,sha256=0u_Nn_XGafjW3LmhGyp39CP9KXfLo02Z9ivDAsHvKmA,6166
+flowerpower/pipeline/executor.py,sha256=AAiMbNKIQKNrumu1lavG_yVK9rzhPYjZAIt0BxAbJjc,4567
+flowerpower/pipeline/io.py,sha256=phYJhN4LZ0c6d8_udEQ4C9cGzeV3Ku0hsj0gyE1n2UY,16246
+flowerpower/pipeline/lifecycle_manager.py,sha256=JKJXdgdwhH8yUYdwlAJp5-dSbDFFb-EqmgiY-O5KIoA,7670
+flowerpower/pipeline/manager.py,sha256=XLrCY5x9WmQithe0QmeYonR4LyqzqSQHR-y7cL6DKr4,41143
+flowerpower/pipeline/pipeline.py,sha256=x4nQeKC7irJoD6x2RzU52dN4VGWJFSGTDYKNuDhG7fk,15742
+flowerpower/pipeline/registry.py,sha256=gIc1N7yRm95dEhc5WnZapTK827VeydGxZSYcWFqB10U,30122
+flowerpower/pipeline/visualizer.py,sha256=EVpjv-TUe1zGvdEAWyShJcVXurm02W0jkLbj7z1uAv4,4953
+flowerpower/plugins/io/__init__.py,sha256=ZmSdKoh3TavJagOz0vUItnEqAh3mAM1QpAWj0KufF_k,222
+flowerpower/settings/__init__.py,sha256=XKQa8AI9VrX8ievs-suq3Cm6PBt4cJ78ZHVIjUbXCyA,130
+flowerpower/settings/_backend.py,sha256=Up1RBqAs3jtDUOV-9wEpL68Qmom-dRWMOeHXIh0F3lw,4273
+flowerpower/settings/executor.py,sha256=vNF383g1gMGkq_CXUzateGMNcJZig-vHkVVb0Hi_b74,249
+flowerpower/settings/general.py,sha256=RxY6PGF_L8ApFlLPHulZ2I8_-aHYqOj63fUu9kSQTjI,227
+flowerpower/settings/hamilton.py,sha256=GVzWKz3B-wy07etY1mNUstEa4DFrQ_lM2cjE0qG_6qw,623
+flowerpower/settings/logging.py,sha256=BHahxfuiofByiTU8TYQ2AObPDRz9SYH-MalSEu1DRro,71
+flowerpower/settings/retry.py,sha256=W3AAVSxmTUAeeSbzRGA37RxqtKKyUdi2MkwDzCsXP94,181
+flowerpower/utils/__init__.py,sha256=SGFNcfks88cBRoxQnLIfHX3BTXcKf-SbWo-zxklXDJY,533
+flowerpower/utils/adapter.py,sha256=3axZ1QIf72x_2AiS7F7X2ySrHkZQnhMnpGel6-9psVU,9645
+flowerpower/utils/callback.py,sha256=ZIDMGwR30m35Fmj-mChkgAhZ0Zf8HeNtsGdsZ727hIQ,6916
+flowerpower/utils/config.py,sha256=JC_kKq9-VJrW7ndWiehm5s-C0JG4_4oBffuwhVbaibQ,11507
+flowerpower/utils/executor.py,sha256=AqO1RLxI9uKWX9OPu9uK6yOX2CNQMptRKpvcG2o-tak,6258
+flowerpower/utils/filesystem.py,sha256=W5kpJ0IERSsI3hQd7XFtbuk9bcIXidl7Qgw2bQVOkd0,6346
+flowerpower/utils/logging.py,sha256=WUnpoEmr9H5MGFF68jlshhEJcuMtW49M7VVRstmqIAg,1192
+flowerpower/utils/misc.py,sha256=_BbAXmcbhDm5Y-RpW-HhJ5txu8KoaDQjdmRJwzNs7aM,14649
+flowerpower/utils/monkey.py,sha256=vJMYANjZI13PNbEQThdX0EFP1_6bGNHgnpF7HwReNyM,58
+flowerpower/utils/open_telemetry.py,sha256=fQWJWbIQFtKIxMBjAWeF12NGnqT0isO3A3j-DSOv_vE,949
+flowerpower/utils/security.py,sha256=7TPwD4nqjVm2rFBjJ0qM86wEQql-9j3Jo8udV3mSBoA,7113
+flowerpower/utils/templates.py,sha256=ouyEeSDqa9PjW8c32fGpcINlpC0WToawRFZkMPtwsLE,1591
+flowerpower-0.31.1.dist-info/licenses/LICENSE,sha256=9AkLexxrmr0aBgSHiqxpJk9wgazpP1CTJyiDyr56J9k,1063
+flowerpower-0.31.1.dist-info/METADATA,sha256=TgvnINYIvNKmijCZg0U11cHEFzC2eEA3LzO_8YuwdFc,17202
+flowerpower-0.31.1.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+flowerpower-0.31.1.dist-info/entry_points.txt,sha256=61X11i5a2IwC9LBiP20XCDl5zMOigGCjMCx17B7bDbQ,52
+flowerpower-0.31.1.dist-info/top_level.txt,sha256=VraH4WtEUfSxs5L-rXwDQhzQb9eLHTUtgvmFZ2dAYnA,12
+flowerpower-0.31.1.dist-info/RECORD,,

flowerpower/cfg/pipeline/_schedule.py

@@ -1,32 +0,0 @@
-import datetime as dt
-
-import msgspec
-from munch import munchify
-
-from ..base import BaseConfig
-
-
-class ScheduleConfig(BaseConfig):
-    cron: str | dict | None = msgspec.field(default=None)
-    interval: str | int | dict | None = msgspec.field(default=None)
-    date: str | None = msgspec.field(default=None)
-
-    def __post_init__(self):
-        if isinstance(self.date, str):
-            try:
-                self.date = dt.datetime.fromisoformat(self.date)
-            except ValueError:
-                raise ValueError(
-                    f"Invalid date format: {self.date}. Expected ISO format."
-                )
-        if isinstance(self.cron, dict):
-            self.cron = munchify(self.cron)
-        if isinstance(self.interval, dict):
-            self.interval = munchify(self.interval)
-
-
-# class ScheduleConfig(BaseConfig):
-#     run: ScheduleRunConfig = msgspec.field(default_factory=ScheduleRunConfig)
-#     trigger: ScheduleTriggerConfig = msgspec.field(
-#         default_factory=ScheduleTriggerConfig
-#     )

flowerpower-0.30.0.dist-info/RECORD

@@ -1,42 +0,0 @@
-flowerpower/__init__.py,sha256=nHFrD6twJyR-Ti6Yn0lLcyXXcKOi0tFfOD96oAu17Js,431
-flowerpower/flowerpower.py,sha256=-taA0uemnoy1B5ugNxzwQ_Jir8jfmaGNXTk_uewaN88,23755
-flowerpower/cfg/__init__.py,sha256=aWeKlBNgJ4LCtWBzZns5RmQm9GN9SpTbozE-NsS2_9w,8481
-flowerpower/cfg/base.py,sha256=IpvCcUvGTjmjN69D34IFNn692hxTwZzYQJ1utgKANWo,4795
-flowerpower/cfg/pipeline/__init__.py,sha256=HSUlDt9smo-zPqOljEl329CQg8qsd0EJfCH1FOtuMdk,9276
-flowerpower/cfg/pipeline/_schedule.py,sha256=kaDyij3eUj0u6VdmJW4x_AQbSAZ-r7s2Fk7QFkXU5JQ,1029
-flowerpower/cfg/pipeline/adapter.py,sha256=uBKV6BZlsRRqSYNyC1oEWPchsaH7rFPCBobG5BrF3ss,2265
-flowerpower/cfg/pipeline/builder.py,sha256=rZ-cspbV-nwtckvOA49vt7DNJNb-gRLHHWiejmJPsFs,13192
-flowerpower/cfg/pipeline/run.py,sha256=cirZbiHsY8D87idBvbfNv1gEtKpgv3xLfiiFIXJFxrA,6733
-flowerpower/cfg/project/__init__.py,sha256=bMMZ5Zo3YgkgOGt82H1mW8I4WnoCUpa0bSLPpZiB7K4,4560
-flowerpower/cfg/project/adapter.py,sha256=2k2U25NziDEiUacLTjxaSxOVkaQBRt6ECWGRGX0v4J0,1481
-flowerpower/cli/__init__.py,sha256=RkJT3mPlSOi55dNNP8kpm_omF0zEfbmWVP16N-lkijE,4897
-flowerpower/cli/cfg.py,sha256=P7qEcjraitMxbzVWJMqWeitIdpUkW41QkUi7ol0ksW0,1455
-flowerpower/cli/pipeline.py,sha256=I58cWjK7J4dkXdJXIePcPiD7iILnYqoje0ztkR5mNwg,21958
-flowerpower/cli/utils.py,sha256=tsxvKIqUhl4m9IzuaSoc5a3_gb6Fu4LYyV8fVodqIdA,5127
-flowerpower/pipeline/__init__.py,sha256=ltr4LQnM5Boa9w7t-lNVmmcSglIkTPuIoeYnEKWU4Og,122
-flowerpower/pipeline/base.py,sha256=oQSDfEAyY2_kDRlHNnHr6ihZvfGeOjyMJRPKob1i7U8,3560
-flowerpower/pipeline/io.py,sha256=phYJhN4LZ0c6d8_udEQ4C9cGzeV3Ku0hsj0gyE1n2UY,16246
-flowerpower/pipeline/manager.py,sha256=gJMWe_T1WpxO2H9GDrNtf61S4oJuLugMHwX82jqAuEU,47579
-flowerpower/pipeline/pipeline.py,sha256=8Vhc3GGoAJI-5zv8qX4gZ5JwJrTdVoiXHWNpv5OeKGw,26207
-flowerpower/pipeline/registry.py,sha256=iHdEBPiRpZorAUe6sDkqONoP8t6cicdQYGdK8UyxuAQ,28791
-flowerpower/pipeline/visualizer.py,sha256=EVpjv-TUe1zGvdEAWyShJcVXurm02W0jkLbj7z1uAv4,4953
-flowerpower/plugins/io/__init__.py,sha256=ZmSdKoh3TavJagOz0vUItnEqAh3mAM1QpAWj0KufF_k,222
-flowerpower/settings/__init__.py,sha256=XKQa8AI9VrX8ievs-suq3Cm6PBt4cJ78ZHVIjUbXCyA,130
-flowerpower/settings/_backend.py,sha256=Up1RBqAs3jtDUOV-9wEpL68Qmom-dRWMOeHXIh0F3lw,4273
-flowerpower/settings/executor.py,sha256=vNF383g1gMGkq_CXUzateGMNcJZig-vHkVVb0Hi_b74,249
-flowerpower/settings/general.py,sha256=RxY6PGF_L8ApFlLPHulZ2I8_-aHYqOj63fUu9kSQTjI,227
-flowerpower/settings/hamilton.py,sha256=GVzWKz3B-wy07etY1mNUstEa4DFrQ_lM2cjE0qG_6qw,623
-flowerpower/settings/logging.py,sha256=BHahxfuiofByiTU8TYQ2AObPDRz9SYH-MalSEu1DRro,71
-flowerpower/settings/retry.py,sha256=W3AAVSxmTUAeeSbzRGA37RxqtKKyUdi2MkwDzCsXP94,181
-flowerpower/utils/callback.py,sha256=sGYSrEbnl0xfRa1X-mA-om3erpH7pmpsWdyPQ9HpU7E,6736
-flowerpower/utils/logging.py,sha256=WUnpoEmr9H5MGFF68jlshhEJcuMtW49M7VVRstmqIAg,1192
-flowerpower/utils/misc.py,sha256=gY1KVJp4lF4S0THUu1LUrjXaf87TzLO-TcwHxZZh2Zk,8414
-flowerpower/utils/monkey.py,sha256=vJMYANjZI13PNbEQThdX0EFP1_6bGNHgnpF7HwReNyM,58
-flowerpower/utils/open_telemetry.py,sha256=fQWJWbIQFtKIxMBjAWeF12NGnqT0isO3A3j-DSOv_vE,949
-flowerpower/utils/templates.py,sha256=ouyEeSDqa9PjW8c32fGpcINlpC0WToawRFZkMPtwsLE,1591
-flowerpower-0.30.0.dist-info/licenses/LICENSE,sha256=9AkLexxrmr0aBgSHiqxpJk9wgazpP1CTJyiDyr56J9k,1063
-flowerpower-0.30.0.dist-info/METADATA,sha256=3nPehMWbDcryhbkgbieU-_13I_8S3-1aNL54bMdjdDs,17208
-flowerpower-0.30.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-flowerpower-0.30.0.dist-info/entry_points.txt,sha256=61X11i5a2IwC9LBiP20XCDl5zMOigGCjMCx17B7bDbQ,52
-flowerpower-0.30.0.dist-info/top_level.txt,sha256=VraH4WtEUfSxs5L-rXwDQhzQb9eLHTUtgvmFZ2dAYnA,12
-flowerpower-0.30.0.dist-info/RECORD,,