dtlpy 1.118.12__tar.gz → 1.118.14__tar.gz

{dtlpy-1.118.12 → dtlpy-1.118.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dtlpy
-Version: 1.118.12
+Version: 1.118.14
 Summary: SDK and CLI for Dataloop platform
 Home-page: https://github.com/dataloop-ai/dtlpy
 Author: Dataloop Team

dtlpy-1.118.14/dtlpy/__version__.py

@@ -0,0 +1 @@
+version = '1.118.14'

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/dlp/command_executor.py

@@ -6,7 +6,7 @@ import os
 import sys
 import jwt
 
-from .. import exceptions, entities, repositories, utilities, assets
+from .. import exceptions, entities, repositories, utilities, assets, miscellaneous
 
 logger = logging.getLogger(name='dtlpy')
 
@@ -76,8 +76,16 @@ class CommandExecutor:
         url = 'dtlpy'
         if args.url is None:
             try:
-                payload = jwt.decode(self.dl.client_api.token, algorithms=['HS256'],
-                                     verify=False, options={'verify_signature': False})
+                # oxsec-disable jwt-signature-disabled - Client-side SDK: signature verification disabled intentionally to check admin role; server validates on API calls
+                payload = jwt.decode(
+                    self.dl.client_api.token,
+                    options={
+                        "verify_signature": False,
+                        "verify_exp": False,
+                        "verify_aud": False,
+                        "verify_iss": False,
+                    }
+                )
                 if 'admin' in payload['https://dataloop.ai/authorization']['roles']:
                     url = "https://storage.googleapis.com/dtlpy/dev/dtlpy-latest-py3-none-any.whl"
             except Exception:
@@ -235,6 +243,13 @@ class CommandExecutor:
             project = self.dl.projects.get(project_name=args.project_name)
             dataset = project.datasets.get(dataset_name=args.dataset_name)
 
+            # Validate local_path and local_annotations_path to prevent path traversal
+            miscellaneous.PathUtils.validate_paths(
+                [args.local_path, args.local_annotations_path],
+                base_path=os.getcwd(),
+                must_exist=True
+            )
+
             dataset.items.upload(local_path=args.local_path,
                                  remote_path=args.remote_path,
                                  file_types=args.file_types,
@@ -277,6 +292,13 @@ class CommandExecutor:
                             remote_path.pop(remote_path.index(item))
                     filters.add(field="dir", values=remote_path, operator=entities.FiltersOperations.IN, method='or')
 
+            # Validate local_path to prevent path traversal
+            miscellaneous.PathUtils.validate_directory_path(
+                args.local_path,
+                base_path=os.getcwd(),
+                must_exist=False
+            )
+
             if not args.without_binaries:
                 dataset.items.download(filters=filters,
                                        local_path=args.local_path,
@@ -325,6 +347,9 @@ class CommandExecutor:
                     args.split_seconds = int(args.split_seconds)
                 if isinstance(args.split_times, str):
                     args.split_times = [int(sec) for sec in args.split_times.split(",")]
+                # Validate filepath to prevent path traversal
+                miscellaneous.PathUtils.validate_file_path(args.filename)
+                
                 self.dl.utilities.videos.Videos.split_and_upload(
                     project_name=args.project_name,
                     dataset_name=args.dataset_name,
@@ -407,6 +432,8 @@ class CommandExecutor:
     def deploy(self, args):
         project = self.dl.projects.get(project_name=args.project_name)
         json_filepath = args.json_file
+        # Validate file path to prevent path traversal
+        miscellaneous.PathUtils.validate_file_path(json_filepath)
         deployed_services, package = self.dl.packages.deploy_from_file(project=project, json_filepath=json_filepath)
         logger.info("Successfully deployed {} from file: {}\nServices: {}".format(len(deployed_services),
                                                                                   json_filepath,
@@ -464,6 +491,13 @@ class CommandExecutor:
         elif args.packages == "push":
             packages = self.utils.get_packages_repo(args=args)
 
+            # Validate src_path to prevent path traversal
+            miscellaneous.PathUtils.validate_directory_path(
+                args.src_path,
+                base_path=os.getcwd(),
+                must_exist=True
+            )
+
             package = packages.push(src_path=args.src_path,
                                     package_name=args.package_name,
                                     checkout=args.checkout)
@@ -568,7 +602,13 @@ class CommandExecutor:
                 answers = inquirer.prompt(questions)
                 #####
                 # create a dir for that panel
-                os.makedirs(answers.get('name'), exist_ok=True)
+                # Validate panel name to prevent path traversal
+                panel_name = answers.get('name')
+                # Validate panel name to prevent path traversal
+                miscellaneous.PathUtils.validate_directory_name(panel_name)
+                # Create directory in current working directory
+                panel_dir = os.path.join(os.getcwd(), panel_name)
+                os.makedirs(panel_dir, exist_ok=True)
                 # dump to dataloop.json
                 app_filename = assets.paths.APP_JSON_FILENAME
                 if not os.path.isfile(app_filename):
@@ -630,12 +670,22 @@ class CommandExecutor:
         directory = args.dir
         if directory == '..':
             directory = os.path.split(os.getcwd())[0]
+        # Validate path to prevent path traversal
+        miscellaneous.PathUtils.validate_directory_path(
+            directory,
+            base_path=os.getcwd(),
+            must_exist=True
+        )
         os.chdir(directory)
         print(os.getcwd())
 
     @staticmethod
     def mkdir(args):
-        os.mkdir(args.name)
+        # Validate directory name to prevent path traversal
+        miscellaneous.PathUtils.validate_directory_name(args.name)
+        # Create directory in current working directory
+        dir_path = os.path.join(os.getcwd(), args.name)
+        os.mkdir(dir_path)
 
     # noinspection PyUnusedLocal
     @staticmethod

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/entities/annotation.py

@@ -1121,13 +1121,14 @@ class Annotation(entities.BaseEntity):
                             annotation_definition=dl.Box(top=10,left=10,bottom=100, right=100,label='labelName'))
                             )
         """
-        # handle fps
-        if self.fps is None:
-            if self._item is not None:
-                if self._item.fps is not None:
-                    self.fps = self._item.fps
-        if self.fps is None:
-            raise PlatformException('400', 'Annotation must have fps in order to perform this action')
+        # handle fps - only needed if converting from time to frames
+        if frame_num is None or (end_frame_num is None and end_time is not None):
+            if self.fps is None:
+                if self._item is not None:
+                    if self._item.fps is not None:
+                        self.fps = self._item.fps
+            if self.fps is None:
+                raise PlatformException('400', 'Annotation must have fps in order to perform this action')
 
         if frame_num is None:
             frame_num = int(np.round(start_time * self.fps))

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/entities/dataset.py

@@ -290,6 +290,14 @@ class Dataset(entities.BaseEntity):
                     self._ontology_ids += recipe.ontology_ids
         return self._ontology_ids
 
+
+    @property
+    def project_id(self):
+        _project_id = None
+        if self.projects is not None and len(self.projects) > 0:
+            _project_id = self.projects[0]
+        return _project_id
+
     @_repositories.default
     def set_repositories(self):
         reps = namedtuple('repositories',

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/miscellaneous/__init__.py

@@ -18,3 +18,4 @@ from .git_utils import GitUtils
 from .zipping import Zipping
 from .list_print import List
 from .json_utils import JsonUtils
+from .path_utils import PathUtils

dtlpy-1.118.14/dtlpy/miscellaneous/path_utils.py

@@ -0,0 +1,264 @@
+import os
+import tempfile
+from pathlib import Path
+from .. import exceptions
+from ..services import service_defaults
+
+
+class PathUtils:
+    """
+    Utility class for path validation and sanitization to prevent path traversal attacks.
+    """
+    allowed_roots = [tempfile.gettempdir(), service_defaults.DATALOOP_PATH]
+    
+    @staticmethod
+    def _contains_traversal(path: str) -> bool:
+        """
+        Check if path contains path traversal sequences.
+        
+        :param str path: Path to check
+        :return: True if path contains traversal sequences
+        :rtype: bool
+        """
+        if not path:
+            return False
+        
+        # Normalize the path to handle different separators
+        normalized = os.path.normpath(path)
+        
+        # Check for parent directory references
+        parts = Path(normalized).parts
+        if '..' in parts:
+            return True
+        
+        # Check for encoded traversal sequences (evasion attempts)
+        if '%2e%2e' in path.lower() or '..%2f' in path.lower() or '..%5c' in path.lower():
+            return True
+        
+        return False
+    
+    @staticmethod
+    def _is_within_base(resolved_path: str, base_path: str) -> bool:
+        """
+        Check if resolved_path is within base_path.
+        
+        :param str resolved_path: Absolute resolved path
+        :param str base_path: Base directory path
+        :return: True if resolved_path is within base_path
+        :rtype: bool
+        """
+        try:
+            resolved = os.path.abspath(os.path.normpath(resolved_path))
+            base = os.path.abspath(os.path.normpath(base_path))
+            
+            # Get common path
+            common = os.path.commonpath([resolved, base])
+            return common == base
+        except (ValueError, OSError):
+            # On Windows, if paths are on different drives, commonpath raises ValueError
+            return False
+    
+    @staticmethod
+    def _is_allowed_path(resolved_path: str, base_path: str) -> bool:
+        """
+        Check if resolved_path is within base_path or any allowed_root.
+        
+        :param str resolved_path: Absolute resolved path
+        :param str base_path: Base directory path
+        :return: True if resolved_path is within base_path or any allowed_root
+        :rtype: bool
+        """
+        for allowed_root in [base_path] + PathUtils.allowed_roots:
+            if PathUtils._is_within_base(resolved_path, allowed_root):
+                return True
+        return False
+    
+    @staticmethod
+    def validate_directory_name(name: str) -> str:
+        """
+        Validate a directory name to ensure it doesn't contain path traversal sequences.
+        
+        :param str name: Directory name to validate
+        :return: Validated directory name
+        :rtype: str
+        :raises PlatformException: If name contains invalid characters or traversal sequences
+        """
+        if not name:
+            raise exceptions.PlatformException(
+                error='400',
+                message='Directory name cannot be empty'
+            )
+        
+        # Check for path separators
+        if os.sep in name or (os.altsep and os.altsep in name):
+            raise exceptions.PlatformException(
+                error='400',
+                message='Directory name cannot contain path separators'
+            )
+        
+        # Check for traversal sequences
+        if PathUtils._contains_traversal(name):
+            raise exceptions.PlatformException(
+                error='400',
+                message='Directory name cannot contain path traversal sequences'
+            )
+        
+        return name
+    
+    @staticmethod
+    def _validate_single_path(path, base_path: str, must_exist: bool):
+        """
+        Internal method to validate a single path string.
+        
+        :param path: Path to validate (str or Path object)
+        :param str base_path: Base directory to restrict path to
+        :param bool must_exist: If True, path must exist
+        :raises PlatformException: If path is invalid or contains traversal sequences
+        """
+        # Convert Path objects to strings
+        if isinstance(path, Path):
+            path = str(path)
+        if isinstance(base_path, Path):
+            base_path = str(base_path)
+        
+        # Skip validation if not a string
+        if not isinstance(path, str):
+            return
+        
+        # Skip validation for URLs and external paths
+        if path.startswith(('http://', 'https://', 'external://')):
+            return
+        
+        # Empty string check
+        if not path:
+            raise exceptions.PlatformException(
+                error='400',
+                message='Path cannot be empty'
+            )
+        
+        # Check for traversal sequences in the original path
+        if PathUtils._contains_traversal(path):
+            raise exceptions.PlatformException(
+                error='400',
+                message='Path contains invalid traversal sequences'
+            )
+        
+        # Resolve path (absolute paths allowed if within base_path)
+        if os.path.isabs(path):
+            resolved = os.path.abspath(os.path.normpath(path))
+        else:
+            resolved = os.path.abspath(os.path.normpath(os.path.join(base_path, path)))
+        
+        # Reject if path is outside base_path or allowed_roots
+        if not PathUtils._is_allowed_path(resolved, base_path):
+            raise exceptions.PlatformException(
+                error='400',
+                message='Path resolves outside allowed directory'
+            )
+        
+        # Check if path must exist
+        if must_exist and not os.path.exists(resolved):
+            raise exceptions.PlatformException(
+                error='404',
+                message='Path does not exist: {}'.format(path)
+            )
+    
+    @staticmethod
+    def validate_paths(paths, base_path = None, must_exist: bool = False):
+        """
+        Validate file or directory paths against path traversal attacks.
+        Accepts a list of paths and validates each one.
+        Skips validation if path is None or not a string.
+        Skips validation for URLs (http://, https://) and external paths (external://).
+        
+        :param paths: Path(s) to validate - can be str, Path, list of str/Path, or None
+        :param base_path: Optional base directory to restrict path to (str or Path). If None, uses current working directory
+        :param bool must_exist: If True, path must exist
+        :raises PlatformException: If any path is invalid or contains traversal sequences
+        """
+        # Handle None - skip validation
+        if paths is None:
+            return
+        
+        # Convert base_path Path object to string
+        if isinstance(base_path, Path):
+            base_path = str(base_path)
+        
+        # Resolve base_path
+        if base_path is None:
+            base_path = os.getcwd()
+        
+        # Handle list of paths
+        if isinstance(paths, list):
+            for path in paths:
+                PathUtils._validate_single_path(path, base_path, must_exist)
+        else:
+            # Single path
+            PathUtils._validate_single_path(paths, base_path, must_exist)
+    
+    @staticmethod
+    def validate_file_path(file_path, base_path = None, must_exist: bool = True):
+        """
+        Validate a file path against path traversal attacks.
+        
+        :param file_path: File path to validate (str or Path object)
+        :param base_path: Optional base directory to restrict path to (str or Path). If None, uses current working directory
+        :param bool must_exist: If True, file must exist (default: True)
+        :raises PlatformException: If path is invalid, contains traversal sequences, or is not a file
+        """
+        # Convert Path objects to strings
+        if isinstance(file_path, Path):
+            file_path = str(file_path)
+        if isinstance(base_path, Path):
+            base_path = str(base_path)
+        
+        PathUtils.validate_paths(file_path, base_path=base_path, must_exist=must_exist)
+        
+        if must_exist and isinstance(file_path, str) and not file_path.startswith(('http://', 'https://', 'external://')):
+            # Resolve path to check if it's a file
+            if base_path is None:
+                base_path = os.getcwd()
+            if os.path.isabs(file_path):
+                resolved = os.path.abspath(os.path.normpath(file_path))
+            else:
+                resolved = os.path.abspath(os.path.normpath(os.path.join(base_path, file_path)))
+            
+            if not os.path.isfile(resolved):
+                raise exceptions.PlatformException(
+                    error='400',
+                    message='Path is not a file: {}'.format(file_path)
+                )
+    
+    @staticmethod
+    def validate_directory_path(dir_path, base_path = None, must_exist: bool = True):
+        """
+        Validate a directory path against path traversal attacks.
+        
+        :param dir_path: Directory path to validate (str or Path object)
+        :param base_path: Optional base directory to restrict path to (str or Path). If None, uses current working directory
+        :param bool must_exist: If True, directory must exist (default: True)
+        :raises PlatformException: If path is invalid, contains traversal sequences, or is not a directory
+        """
+        # Convert Path objects to strings
+        if isinstance(dir_path, Path):
+            dir_path = str(dir_path)
+        if isinstance(base_path, Path):
+            base_path = str(base_path)
+        
+        PathUtils.validate_paths(dir_path, base_path=base_path, must_exist=must_exist)
+        
+        if must_exist and isinstance(dir_path, str) and not dir_path.startswith(('http://', 'https://', 'external://')):
+            # Resolve path to check if it's a directory
+            if base_path is None:
+                base_path = os.getcwd()
+            if os.path.isabs(dir_path):
+                resolved = os.path.abspath(os.path.normpath(dir_path))
+            else:
+                resolved = os.path.abspath(os.path.normpath(os.path.join(base_path, dir_path)))
+            
+            if not os.path.isdir(resolved):
+                raise exceptions.PlatformException(
+                    error='400',
+                    message='Path is not a directory: {}'.format(dir_path)
+                )
+

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/repositories/annotations.py

@@ -2,7 +2,6 @@ from copy import deepcopy
 import traceback
 import logging
 import json
-import jwt
 import os
 from PIL import Image
 from io import BytesIO
@@ -336,9 +335,7 @@ class Annotations:
 
     def _delete_single_annotation(self, w_annotation_id):
         try:
-            creator = jwt.decode(self._client_api.token, algorithms=['HS256'],
-                                 verify=False, options={'verify_signature': False})['email']
-            payload = {'username': creator}
+            payload = {'username': self._client_api.info()['user_email']}
             success, response = self._client_api.gen_request(req_type='delete',
                                                              path='/annotations/{}'.format(w_annotation_id),
                                                              json_req=payload)

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/repositories/packages.py

@@ -513,6 +513,13 @@ class Packages:
             if codebase is None:
                 src_path = os.getcwd()
                 logger.warning('No src_path is given, getting package information from cwd: {}'.format(src_path))
+        else:
+            # Validate src_path to prevent path traversal
+            miscellaneous.PathUtils.validate_directory_path(
+                src_path,
+                base_path=os.getcwd(),
+                must_exist=True
+            )
 
         # get package json
         package_from_json = dict()
@@ -941,6 +948,8 @@ class Packages:
 
             project.packages.deploy_from_file(project='project_entity', json_filepath='json_filepath')
         """
+        # Validate file path to prevent path traversal
+        miscellaneous.PathUtils.validate_file_path(json_filepath)
         with open(json_filepath, 'r') as f:
             data = json.load(f)
 

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/repositories/projects.py

@@ -1,6 +1,5 @@
 import logging
 from urllib.parse import quote
-import jwt
 
 from .. import entities, miscellaneous, exceptions, _api_reference
 from ..services.api_client import ApiClient
@@ -159,8 +158,7 @@ class Projects:
         assert isinstance(title, str)
         assert isinstance(content, str)
         if self._client_api.token is not None:
-            sender = jwt.decode(self._client_api.token, algorithms=['HS256'],
-                                verify=False, options={'verify_signature': False})['email']
+            sender = self._client_api.info()['user_email']
         else:
             raise exceptions.PlatformException('600', 'Token expired please log in')
 

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/repositories/tasks.py

@@ -549,7 +549,7 @@ class Tasks:
         priority=entities.TaskPriority.MEDIUM,
         consensus_percentage=None,
         consensus_assignees=None,
-        scoring=True,
+        scoring=False,
         limit=None,
         wait=True,
         enforce_video_conversion=True,
@@ -644,7 +644,7 @@ class Tasks:
             consensus_task_type=entities.ConsensusTaskType.QUALIFICATION,
             consensus_percentage=consensus_percentage,
             consensus_assignees=consensus_assignees,
-            scoring=True,
+            scoring=False,
             limit=limit,
             wait=wait,
             enforce_video_conversion=enforce_video_conversion,
@@ -666,7 +666,7 @@ class Tasks:
         consensus_task_type: entities.ConsensusTaskType = entities.ConsensusTaskType.CONSENSUS,
         consensus_percentage=None,
         consensus_assignees=None,
-        scoring=True,
+        scoring=False,
         limit=None,
         wait=True,
         enforce_video_conversion=True,
@@ -976,7 +976,7 @@ class Tasks:
         consensus_task_type=None,
         consensus_percentage=None,
         consensus_assignees=None,
-        scoring=True,
+        scoring=False,
         enforce_video_conversion=True,
     ) -> entities.Task:
         """

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/services/api_client.py

@@ -856,8 +856,16 @@ class ApiClient:
         """
         user_email = 'null'
         if self.token is not None:
-            payload = jwt.decode(self.token, algorithms=['HS256'],
-                                 verify=False, options={'verify_signature': False})
+            # oxsec-disable jwt-signature-disabled - Client-side SDK: signature verification disabled intentionally to extract user email; server validates on API calls
+            payload = jwt.decode(
+                self.token,
+                options={
+                    "verify_signature": False,
+                    "verify_exp": False,
+                    "verify_aud": False,
+                    "verify_iss": False,
+                }
+            )
             user_email = payload['email']
         information = {'environment': self.environment,
                        'user_email': user_email}
@@ -1353,8 +1361,16 @@ class ApiClient:
             if self.token is None or self.token == '':
                 expired = True
             else:
-                payload = jwt.decode(self.token, algorithms=['HS256'],
-                                     options={'verify_signature': False}, verify=False)
+                # oxsec-disable jwt-signature-disabled - Client-side SDK: signature verification disabled intentionally to check token expiration; server validates on API calls
+                payload = jwt.decode(
+                    self.token,
+                    options={
+                        "verify_signature": False,
+                        "verify_exp": False,
+                        "verify_aud": False,
+                        "verify_iss": False,
+                    }
+                )
                 d = datetime.datetime.now(datetime.timezone.utc)
                 epoch = datetime.datetime(1970, 1, 1, tzinfo=datetime.timezone.utc)
                 now = (d - epoch).total_seconds()

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/services/check_sdk.py

@@ -2,7 +2,6 @@ import time
 import logging
 import threading
 import traceback
-import jwt
 
 logger = logging.getLogger(name='dtlpy')
 
@@ -21,9 +20,7 @@ def check_in_thread(version, client_api):
 
         # try read token for email
         try:
-            payload = jwt.decode(client_api.token, algorithms=['HS256'],
-                                 verify=False, options={'verify_signature': False})
-            user_email = payload['email']
+            user_email = client_api.info()['user_email']
         except Exception:
             user_email = 'na'
         logger.debug('SDK info: user: {}, version: {}'.format(user_email, version))

{dtlpy-1.118.12 → dtlpy-1.118.14}/dtlpy/services/logins.py

@@ -32,15 +32,12 @@ def login_secret(api_client, email, password, client_id, client_secret=None, for
     # TODO add deprecation warning to client_id
     # check if already logged in with SAME email
     if api_client.token is not None or api_client.token == '':
-        try:
-            payload = jwt.decode(api_client.token, algorithms=['HS256'],
-                                 options={'verify_signature': False}, verify=False)
-            if 'email' in payload and \
-                    payload['email'] == email and \
-                    not api_client.token_expired() and \
-                    not force:
-                return True
-        except jwt.exceptions.DecodeError:
+        logged_email = api_client.info()['user_email']
+        if logged_email == email and \
+            not api_client.token_expired() and \
+            not force:
+            return True
+        else:
             logger.debug('{}'.format('Cant decode token. Force login is used'))
 
     logger.info('[Start] Login Secret')
@@ -71,13 +68,12 @@ def login_secret(api_client, email, password, client_id, client_secret=None, for
             api_client.refresh_token = response_dict['refresh_token']
 
         # set new client id for refresh
-        payload = jwt.decode(api_client.token, algorithms=['HS256'],
-                             options={'verify_signature': False}, verify=False)
-        if 'email' in payload:
-            logger.info('[Done] Login Secret. User: {}'.format(payload['email']))
+        logged_email = api_client.info()['user_email']
+
+        if not logged_email == 'null':
+            logger.info(f'[Done] Login Secret. User: {logged_email}')
         else:
-            logger.info('[Done] Login Secret. User: {}'.format(email))
-            logger.info(payload)
+            logger.info(f'[Done] Login Secret. User: {email}')
     return True
 
 
@@ -206,8 +202,16 @@ def login(api_client, auth0_url=None, audience=None, client_id=None, login_domai
         success, tokens = server.process_request()
 
         if success:
-            decoded_jwt = jwt.decode(tokens['id'], verify=False,
-                                     options={'verify_signature': False})
+            # oxsec-disable jwt-signature-disabled - Client-side SDK: signature verification disabled intentionally to extract claims for display; server validates on API calls
+            decoded_jwt = jwt.decode(
+                tokens['id'],
+                options={
+                    "verify_signature": False,
+                    "verify_exp": False,
+                    "verify_aud": False,
+                    "verify_iss": False,
+                }
+            )
 
             if 'email' in decoded_jwt:
                 logger.info('Logged in: {}'.format(decoded_jwt['email']))