databricks-tellr-app 0.4.2.dev12__tar.gz → 0.4.2.dev13__tar.gz

{databricks_tellr_app-0.4.2.dev12 → databricks_tellr_app-0.4.2.dev13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev12
+Version: 0.4.2.dev13
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev12 → databricks_tellr_app-0.4.2.dev13}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev12
+Version: 0.4.2.dev13
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev12 → databricks_tellr_app-0.4.2.dev13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.2.dev12"
+version = "0.4.2.dev13"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.2.dev12 → databricks_tellr_app-0.4.2.dev13}/src/services/design_system_service.py

@@ -1083,6 +1083,22 @@ _REASON_CORRUPT_EXTRA = (
     "its Info-ZIP Unicode Path extra field (0x7075) is malformed, so the name the "
     "archive means to declare for this entry cannot be read at all"
 )
+_REASON_LOCAL_HEADER = (
+    "its local file header — the second place a .zip records an entry's name — cannot "
+    "be read, so whether the archive states one name for this entry or two cannot be "
+    "established"
+)
+# Distinct from :data:`_REASON_EMPTY`, which is about a name that IS empty everywhere.
+# This one is about a name the ARCHIVE leaves empty while the reader resolves a usable
+# one from an extra field — so the message has to name both halves, or it reads as a
+# complaint about a name the user can see is not empty.
+_REASON_EMPTY_RECORDED_NAME = (
+    "the archive records NO name for this entry at all. An empty central-directory "
+    "name is not a legitimate archive member, and it is not harmless either: an "
+    "Info-ZIP Unicode Path extra field can supply a replacement (its checksum matches "
+    "an empty name trivially), so the entry ends up with a name that was never "
+    "recorded for it"
+)
 _REASON_ABSOLUTE = (
     "it is an absolute path, so it names a location outside the bundle rather than "
     "a file inside it"
@@ -1398,8 +1414,26 @@ def _raw_entry_name(info: zipfile.ZipInfo) -> str:
     ``ZipInfo.__init__`` truncates ``filename`` at the first NUL byte and keeps the
     real central-directory name in ``orig_filename``. Every gate here reads the name
     through this function so validation judges what the archive actually says.
+
+    ABSENT and EMPTY are different answers, and only an explicit ``None`` test tells
+    them apart. ``or`` did not: it fell back to ``filename`` for an ``orig_filename``
+    of ``""`` as readily as for a missing attribute — which is this module's own
+    laundering, performed at the one function whose entire job is to report the raw
+    name. An empty central name is attacker-controlled data with meaning, and CPython
+    will happily REPLACE it: a ``0x7075`` record needs its checksum to match the
+    central name, and the CRC-32 of ``b""`` is 0, so the record is honoured and
+    ``filename`` becomes whatever it declares. The fallback then handed every gate
+    that name, so ``orig_filename != filename`` compared the replacement against
+    itself and the local-header comparison compared against it too. Measured: an entry
+    with an empty central name, a local name of ``slides/benign.bin`` and a record
+    declaring the same passed both and was yielded for storage.
+
+    The empty name is now REPORTED rather than replaced; refusing it is
+    :func:`_entry_identity_refusal`'s call, on :data:`_REASON_EMPTY_RECORDED_NAME`.
+    The ``getattr`` default stays for a ``ZipInfo`` that genuinely lacks the attribute.
     """
-    return getattr(info, "orig_filename", None) or info.filename
+    raw = getattr(info, "orig_filename", None)
+    return info.filename if raw is None else raw
 
 
 # Info-ZIP Unicode Path Extra Field. Its whole purpose is to declare a name for an
@@ -1411,11 +1445,20 @@ _UNICODE_PATH_EXTRA_TAG = 0x7075
 # CRC-32 of the central-directory name.
 _UNICODE_PATH_HEADER_LEN = 5
 
+# Every extra-field record is a 2-byte tag followed by a 2-byte body size. Anything
+# shorter than that cannot be a record at all.
+_EXTRA_RECORD_HEADER_LEN = 4
 
-def _extra_field_name_refusal(info: zipfile.ZipInfo) -> Optional[str]:
+
+def _extra_field_name_refusal(extra: bytes, central: str) -> Optional[str]:
     """Refuse an entry whose EXTRA FIELD declares a different name, else ``None``.
 
-    Parsed from the raw ``info.extra`` bytes on purpose. No stdlib-processed attribute
+    Takes the extra-field BYTES rather than a ``ZipInfo`` because an entry has TWO
+    extra fields — one in the central directory, one in its local file header — and
+    both are walked, by :func:`_entry_identity_refusal`. ``ZipInfo.extra`` is only the
+    central copy.
+
+    Parsed from raw bytes on purpose. No stdlib-processed attribute
     can be trusted as an entry's identity, and this record is the proof: in CPython's
     ``ZipInfo._decodeExtra`` a ``0x7075`` record assigns
     ``self.filename = _sanitize_filename(declared_name)`` and never touches
@@ -1443,12 +1486,21 @@ def _extra_field_name_refusal(info: zipfile.ZipInfo) -> Optional[str]:
     and never the filename. The Unicode COMMENT field (``0x6375``) carries a comment,
     not a path. Unknown tags are skipped by both the stdlib and the loop below.
     """
-    central = _raw_entry_name(info)
-    extra = info.extra or b""
     offset = 0
-    while len(extra) - offset >= 4:
+    while offset < len(extra):
+        # A LEFTOVER too short to be a record header is malformed, not padding. The
+        # extra field is a sequence of records that tile it exactly; the format
+        # defines no filler between or after them. Stopping quietly on a trailing
+        # fragment skipped the shortest possible spelling of the very record this
+        # function exists to read: an extra of exactly b"\x75\x70" is the 0x7075 tag
+        # with its size field and body cut off, and CPython — whose own walk has the
+        # same four-byte floor — opens such an archive without complaint. Whatever
+        # name that record meant to declare cannot be read, which is the condition
+        # the overrun and short-body branches below already refuse.
+        if len(extra) - offset < _EXTRA_RECORD_HEADER_LEN:
+            return _REASON_CORRUPT_EXTRA
         tag, size = struct.unpack_from("<HH", extra, offset)
-        body_start = offset + 4
+        body_start = offset + _EXTRA_RECORD_HEADER_LEN
         body_end = body_start + size
         if body_end > len(extra):
             return _REASON_CORRUPT_EXTRA
@@ -1466,42 +1518,196 @@ def _extra_field_name_refusal(info: zipfile.ZipInfo) -> Optional[str]:
     return None
 
 
-def _entry_verdict_for_info(
-    info: zipfile.ZipInfo, rel_path: Optional[str] = None
-) -> _EntryVerdict:
-    """The verdict for one ZipInfo, judged on the name the archive really records.
+# Local file header layout (APPNOTE 4.3.7), the fixed part of which is 30 bytes:
+# signature, version needed, general-purpose bit flag, ... then the two lengths that
+# say how much variable-length data follows, then the name and the extra field.
+_LOCAL_HEADER_SIGNATURE = b"PK\x03\x04"
+_LOCAL_HEADER_LEN = 30
+_LOCAL_HEADER_FLAGS_OFFSET = 6
+_LOCAL_HEADER_LENGTHS_OFFSET = 26  # file name length u16, then extra field length u16
+# General-purpose bit 11: the name and comment are UTF-8 rather than the historical
+# CP437. Read from the LOCAL header's own flags, because that is the byte a reader
+# consulting this header would use to decode the name beside it.
+_UTF8_NAME_FLAG = 0x800
+
+
+def _local_header_identity(
+    zf: zipfile.ZipFile, info: zipfile.ZipInfo
+) -> "Optional[tuple[str, bytes]]":
+    """The ``(name, extra)`` the entry's LOCAL FILE HEADER records, or ``None``.
+
+    A .zip states every entry's identity TWICE — once in the local file header that
+    precedes its bytes, once in the central directory at the end — and NOTHING in the
+    format makes the two agree. CPython builds ``ZipInfo`` purely from the central
+    copy: ``ZipInfo.extra`` is the central extra and the local one is never parsed at
+    all. So a guard that reads ``info.extra`` alone inspects one of the two names an
+    archive can present, and an attacker simply puts the rewrite in the other:
+    measured, an entry with a clean central name, an EMPTY central extra and a local
+    ``0x7075`` record declaring ``templates/x/.thumbnail\\x00.exe`` (version 1,
+    matching CRC — the form CPython would honour had it looked) was accepted and
+    stored as a live template thumbnail, which is precisely the outcome the central
+    check exists to prevent.
+
+    Read straight from the archive rather than through any ``ZipInfo`` attribute, for
+    the same reason the extra field is: the point is what the bytes say. The header is
+    located by ``info.header_offset`` — an absolute file offset, adjusted by CPython
+    for any prepended data — and parsed at the documented offsets rather than guessed
+    at.
+
+    THE OFFSET IS THE ARCHIVE'S, NOT THE READER'S. ``header_offset`` looks like a value
+    the zip reader vouched for and is nothing of the kind: a central directory record
+    may carry the legacy sentinel ``0xffffffff`` in its 32-bit offset field plus a ZIP64
+    extra field holding a 64-bit replacement, and ``ZipInfo._decodeExtra`` substitutes
+    that verbatim without ever comparing it to the size of the file. A 146-byte archive
+    can therefore claim its entry's local header begins at ``2**64 - 1``. So the offset
+    is bound-checked against the archive's real size BEFORE the seek, and an offset that
+    cannot hold a header is unreadable like any other — which also makes "past the end
+    of the file" and "too large to seek to at all" one case instead of two.
+
+    PRECONDITION on sharing ``zf.fp``, stated rather than assumed. This seeks a file
+    pointer it does not own, and it does so WITHOUT taking ``ZipFile._lock``, so it is
+    not safe in general — a truly concurrent read, or a file object shared with anything
+    outside this ``ZipFile``, could be moved out from under mid-read. It is safe for
+    THIS importer's usage, and only because of four properties that hold together:
+    :func:`import_bundle` wraps the upload in a private :class:`io.BytesIO` that nothing
+    else holds a reference to; the whole-bundle scan runs to completion before any entry
+    is read; ``ZipFile.open``'s reader re-seeks to its own position before every read, so
+    a moved pointer cannot corrupt an open stream; and the asset reads are synchronous
+    ``zf.read`` calls with no interleaving. The position is restored afterwards anyway —
+    it costs one seek and removes the need for a reader of this function to know any of
+    the above.
+
+    ``None`` means the header could not be read as a local file header at all, which
+    callers treat as a refusal (:data:`_REASON_LOCAL_HEADER`) rather than as
+    permission: an entry whose second name is unknown is not an entry with one name.
+    """
+    fp = getattr(zf, "fp", None)
+    if fp is None:
+        return None
+    try:
+        resume_at = fp.tell()
+        try:
+            fp.seek(0, io.SEEK_END)
+            archive_size = fp.tell()
+            offset = info.header_offset
+            # Negative is nonsense and at/after EOF means the header is not there. Both
+            # are checked BEFORE the seek, because a large enough offset does not fail
+            # the seek gracefully — it cannot be converted to a C ssize_t and raises
+            # OverflowError, which is not an OSError and is not a ValueError.
+            if offset < 0 or offset + _LOCAL_HEADER_LEN > archive_size:
+                return None
+            fp.seek(offset)
+            header = fp.read(_LOCAL_HEADER_LEN)
+            if (
+                len(header) != _LOCAL_HEADER_LEN
+                or header[:4] != _LOCAL_HEADER_SIGNATURE
+            ):
+                return None
+            name_len, extra_len = struct.unpack_from(
+                "<HH", header, _LOCAL_HEADER_LENGTHS_OFFSET
+            )
+            name_bytes = fp.read(name_len)
+            extra = fp.read(extra_len)
+        finally:
+            fp.seek(resume_at)
+    except (OSError, ValueError, OverflowError):
+        # A seek on a detached/closed stream raises, and the bound check above cannot
+        # cover an arithmetic surprise nobody has thought of yet — OverflowError is
+        # here as the backstop for the next one, since the whole point of this helper
+        # is that its input is hostile. Unreadable, like any other unparseable header.
+        #
+        # NOT bare ``Exception``: a genuine bug in the parsing this guards must still
+        # crash loudly rather than be laundered into a path refusal.
+        return None
+    if len(name_bytes) != name_len or len(extra) != extra_len:
+        return None
+    (flags,) = struct.unpack_from("<H", header, _LOCAL_HEADER_FLAGS_OFFSET)
+    encoding = "utf-8" if flags & _UTF8_NAME_FLAG else "cp437"
+    try:
+        return name_bytes.decode(encoding), extra
+    except UnicodeDecodeError:
+        return None
 
-    ``rel_path`` is the name to CLASSIFY when it differs from the archive's — the
-    root-prefix-stripped path, for the in-scope iterator. It has to be a separate
-    argument because the template-thumbnail allowlist is anchored at ``templates/``:
-    a wrapped bundle's ``safe/templates/x/.thumbnail`` only matches once ``safe/`` is
-    off. The identity checks below always apply to the FULL recorded name, which is
-    the string a rewrite would have altered.
 
-    TWO identity checks, because there are two independent ways an entry can end up
-    with more than one name, and each is invisible to the other:
+def _entry_identity_refusal(
+    zf: zipfile.ZipFile, info: zipfile.ZipInfo
+) -> Optional[str]:
+    """Refuse an entry that the archive gives more than ONE name, else ``None``.
+
+    THE place every name-rewriting route is collected, so closing one cannot leave
+    another open. There are four, and each is invisible to the others:
 
       1. ``orig_filename != filename`` — the reader rewrote the central name. A NUL
          byte does this: ``templates/x/.thumbnail\\x00.exe`` is truncated to
          ``templates/x/.thumbnail``, which matches the thumbnail allowlist.
-      2. :func:`_extra_field_name_refusal` — an extra field declares a different name.
-         This one DEFEATS check 1 entirely, because the stdlib sanitizes the declared
-         name before assigning it, leaving the two attributes equal.
-
-    Validating the raw name alone would refuse case 1's entry but leave the deeper
-    problem: ``zf.read``/``namelist`` and the rest of the importer key off
-    ``filename``, so raw-name validation and by-name retrieval would be talking about
-    different files. Refusing any divergence keeps one name per entry everywhere,
-    which is the same property the backslash refusal buys (see
+      2. A ``0x7075`` record in the CENTRAL extra declaring another name. This defeats
+         route 1 entirely, because the stdlib sanitizes the declared name before
+         assigning it, leaving the two attributes equal.
+      3. The LOCAL file header's name disagreeing with the central directory's.
+         CPython does compare these, but only inside ``ZipFile.open`` — i.e. only for
+         entries whose bytes are actually read, and only as a ``BadZipFile`` rather
+         than as something the user can act on. Refusing here covers every entry and
+         says what is wrong.
+      4. A ``0x7075`` record in the LOCAL extra. This defeats routes 1-3 together: the
+         central directory is entirely clean, so nothing CPython parses is out of
+         place, while a reader that trusts local headers sees the other name.
+
+    Checked in that order, so the reported reason names the shallowest defect the
+    entry has rather than the deepest.
+
+    All four presuppose that the archive records a name at all, which is why the EMPTY
+    recorded name is refused ahead of them: an entry with no central-directory name has
+    no identity for this function to establish, and every comparison below would be
+    against ``""``. It is reported as the empty name it is rather than as a mismatch
+    with whatever CPython resolved, because that is the fact the user can act on.
+    """
+    central = _raw_entry_name(info)
+    if not central:
+        return _REASON_EMPTY_RECORDED_NAME
+    if central != info.filename:
+        return _REASON_NAME_MISMATCH
+    reason = _extra_field_name_refusal(info.extra or b"", central)
+    if reason is not None:
+        return reason
+    local = _local_header_identity(zf, info)
+    if local is None:
+        return _REASON_LOCAL_HEADER
+    local_name, local_extra = local
+    if local_name != central:
+        return _REASON_NAME_MISMATCH
+    return _extra_field_name_refusal(local_extra, central)
+
+
+def _entry_verdict_for_info(
+    zf: zipfile.ZipFile, info: zipfile.ZipInfo
+) -> _EntryVerdict:
+    """The verdict for one ZipInfo, judged on the name the archive really records.
+
+    The whole-bundle scan's composition of the two shared steps, over the FULL recorded
+    name. :func:`_iter_safe_entries` applies the very same two steps in the very same
+    order but cannot call this, because it has to interleave its root-prefix scoping
+    between them: identity is judged for every member, scoping then decides which
+    entries this import stores, and only those are classified — on the STRIPPED path,
+    because the template-thumbnail allowlist is anchored at ``templates/``. Identity is
+    judged on the full recorded name in both gates, that being the string a rewrite
+    would have altered.
+
+    IDENTITY FIRST, then the path rules. :func:`_entry_identity_refusal` establishes
+    that the entry has exactly ONE name — across both of the archive's copies of it —
+    and only then is that name classified. The order is the point: validating a path
+    that the archive states twice validates whichever copy this reader happened to
+    resolve, while ``zf.read``/``namelist`` and the rest of the importer key off
+    ``filename``. Refusing any divergence keeps one name per entry everywhere, which
+    is the same property the backslash refusal buys (see
     :func:`_entry_path_verdict`).
+
+    ``zf`` is needed because half of what an archive says about an entry lives in the
+    local file header, which no ``ZipInfo`` attribute exposes.
     """
-    raw = _raw_entry_name(info)
-    if raw != info.filename:
-        return _EntryVerdict(_ENTRY_REFUSE, reason=_REASON_NAME_MISMATCH)
-    extra_reason = _extra_field_name_refusal(info)
-    if extra_reason is not None:
-        return _EntryVerdict(_ENTRY_REFUSE, reason=extra_reason)
-    return _classify_bundle_entry(raw if rel_path is None else rel_path)
+    identity_reason = _entry_identity_refusal(zf, info)
+    if identity_reason is not None:
+        return _EntryVerdict(_ENTRY_REFUSE, reason=identity_reason)
+    return _classify_bundle_entry(_raw_entry_name(info))
 
 
 def _is_symlink(info: zipfile.ZipInfo) -> bool:
@@ -1558,15 +1764,22 @@ def _assert_bundle_paths_safe(zf: zipfile.ZipFile) -> None:
 
     THIS GATE ESTABLISHES THE INVARIANT THE REST OF THE IMPORTER RELIES ON. It runs
     before root discovery and before any read (see :func:`import_bundle`), and it
-    refuses any entry whose recorded name differs from the name Python reports or
-    which contains a ``\\``. Everything downstream — :func:`_locate_root_prefix`,
-    the ``startswith(root_prefix)`` scoping and slicing in
-    :func:`_iter_safe_entries`, and ``zf.read``-by-name — therefore works on names
-    that are exactly what validation judged. Weakening either refusal reintroduces
-    two path identities in one importer.
-
-    The verdict comes from :func:`_entry_verdict_for_info`, the SAME judgement
-    :func:`_iter_safe_entries` uses, so the two gates cannot disagree about an entry.
+    refuses any entry the archive gives more than one name — whether the divergence is
+    between ``orig_filename`` and ``filename``, between the two headers that record
+    the entry, or in a name-rewriting extra field in either of them
+    (:func:`_entry_identity_refusal`) — as well as any name containing a ``\\``.
+    Everything downstream — :func:`_locate_root_prefix`, the
+    ``startswith(root_prefix)`` scoping and slicing in :func:`_iter_safe_entries`, and
+    ``zf.read``-by-name — therefore works on names that are exactly what validation
+    judged. Weakening any of those refusals reintroduces two path identities in one
+    importer.
+
+    The verdict comes from :func:`_entry_verdict_for_info`, which composes the SAME two
+    shared steps :func:`_iter_safe_entries` applies —
+    :func:`_entry_identity_refusal` then :func:`_classify_bundle_entry` — so the two
+    gates cannot disagree about an entry. The iterator runs them either side of its own
+    root-prefix scoping, which is why it composes them itself rather than calling this
+    gate's helper; the classifiers are shared, so there is still exactly one of each.
     """
     claimed: dict[str, str] = {}
     for info in zf.infolist():
@@ -1579,7 +1792,7 @@ def _assert_bundle_paths_safe(zf: zipfile.ZipFile) -> None:
                 f"Bundle entry {name!r} is a symlink; refusing to import."
             )
         # No ``if name`` guard: an empty name is refused, not skipped.
-        verdict = _entry_verdict_for_info(info)
+        verdict = _entry_verdict_for_info(zf, info)
         if verdict.kind == _ENTRY_REFUSE:
             raise DesignSystemImportError(_path_refusal_message(name, verdict.reason))
         if verdict.kind == _ENTRY_FILE:
@@ -1594,7 +1807,8 @@ def _iter_safe_entries(
     """Yield ``(ZipInfo, safe_rel_path)`` for every in-scope bundle FILE entry.
 
     Skips directories, OS junk (``__MACOSX``, ``.DS_Store``) and dotfiles. Raises
-    :class:`DesignSystemImportError` on a zip-slip path (absolute or ``..``) so a
+    :class:`DesignSystemImportError` on an in-scope zip-slip path (absolute or ``..``),
+    and on ANY entry the archive gives more than one name wherever it sits, so a
     malicious bundle is rejected rather than silently stored.
 
     This is the ACTUAL first gate every entry passes, so the ONE dot-prefixed shape
@@ -1603,12 +1817,19 @@ def _iter_safe_entries(
     the recognizer alone reads as working in a unit test and still drops every real
     thumbnail, because the entry never reaches the recognizer.
 
-    Every path rule lives in :func:`_classify_bundle_entry`, reached through
-    :func:`_entry_verdict_for_info` — the same judgement the up-front scan uses — so
-    neither gate can be patched into disagreeing with the other. Stripping
-    ``root_prefix`` is the only work done here, and it is bookkeeping rather than a
-    path rule: it is a raw slice, which is sound precisely because no validated name
-    is ever a rewritten one (no ``\\`` fold, no stdlib truncation).
+    Judged in TWO STEPS, in the same order :func:`_entry_verdict_for_info` applies them
+    for the up-front scan, with the scoping filter interleaved between the two:
+    :func:`_entry_identity_refusal` for every member, then
+    :func:`_classify_bundle_entry` for the ones this import is scoped to. Both halves
+    are the SHARED helpers, so neither gate can be patched into disagreeing with the
+    other. Interleaving is what keeps the two halves' different natures straight: an
+    entry outside the root is legitimately none of this import's business, while an
+    entry the archive names twice is hostile wherever it sits — see the comments at the
+    two steps.
+
+    Stripping ``root_prefix`` is the only work done here, and it is bookkeeping rather
+    than a path rule: it is a raw slice, which is sound precisely because no validated
+    name is ever a rewritten one (no ``\\`` fold, no stdlib truncation).
 
     Two in-scope entries claiming ONE path are refused here as well as by the up-front
     scan, so every path this yields is DISTINCT and callers do not need a first-wins
@@ -1625,12 +1846,45 @@ def _iter_safe_entries(
     claimed: dict[str, str] = {}
     for info in zf.infolist():
         name = _raw_entry_name(info)
+        # IDENTITY BEFORE SCOPE, for EVERY member. Whether the archive gives this entry
+        # ONE name is a fact about the entry, true wherever it sits, so it is settled
+        # before the scoping below decides whether this import has any interest in it.
+        # Ordering these the other way round left the iterator judging only what the
+        # scope filter let through, and an entry it dropped was never judged at all: an
+        # EMPTY recorded name is "in scope" of every prefix and strips to nothing, so
+        # ``not rel_raw`` SKIPPED it — the one shape that is hostile precisely because
+        # the archive records no name for it.
+        #
+        # Nothing was exploitable: :func:`_assert_bundle_paths_safe` runs first on every
+        # production path and refuses such an entry before root discovery or any read.
+        # What was lost is that this gate no longer refused INDEPENDENTLY, which is the
+        # entire value of having two.
+        identity_reason = _entry_identity_refusal(zf, info)
+        if identity_reason is not None:
+            raise DesignSystemImportError(
+                _path_refusal_message(name, identity_reason)
+            )
+        # SCOPE, unchanged and still SILENT. An entry outside the discovered root is
+        # not one of the entries this import stores, so it is passed over rather than
+        # refused — including one whose PATH is unsafe, which the whole-bundle scan
+        # already refuses GLOBALLY (see :func:`_assert_bundle_paths_safe`). Raising here
+        # on an out-of-scope path would widen this generator from "the entries this
+        # import stores" to "every entry in the archive", which is a different contract
+        # from the one its caller has. Identity is not that: it is judged above because
+        # no root prefix makes a second name acceptable.
         if not name.startswith(root_prefix):
             continue
         rel_raw = name[len(root_prefix):]
         if not rel_raw:
             continue  # the root-prefix directory entry itself
-        verdict = _entry_verdict_for_info(info, rel_raw)
+        # The STRIPPED path is what gets classified — the reason this is
+        # :func:`_classify_bundle_entry` directly rather than
+        # :func:`_entry_verdict_for_info`, whose identity half has already run above.
+        # The template-thumbnail allowlist is anchored at ``templates/``, so a wrapped
+        # bundle's ``safe/templates/x/.thumbnail`` only matches once ``safe/`` is off;
+        # the identity check above deliberately used the FULL recorded name instead,
+        # which is the string a rewrite would have altered.
+        verdict = _classify_bundle_entry(rel_raw)
         if verdict.kind == _ENTRY_REFUSE:
             raise DesignSystemImportError(
                 _path_refusal_message(rel_raw, verdict.reason)