hdx-python-api 6.7.5__py3-none-any.whl → 6.7.6__py3-none-any.whl

hdx/api/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '6.7.5'
-__version_tuple__ = version_tuple = (6, 7, 5)
+__version__ = version = '6.7.6'
+__version_tuple__ = version_tuple = (6, 7, 6)
 
 __commit_id__ = commit_id = None

hdx/data/resource.py

@@ -4,13 +4,15 @@ import json
 import logging
 from collections.abc import Iterator, Sequence
 from datetime import datetime
-from pathlib import Path
+from pathlib import Path, PureWindowsPath
 from typing import Any, Optional
+from urllib.parse import urlsplit
 
 from hdx.utilities.dateparse import now_utc, now_utc_notz, parse_date
 from hdx.utilities.downloader import Download
 from hdx.utilities.file_hashing import get_size_and_hash
 from hdx.utilities.retriever import Retrieve
+from hdx.utilities.session import get_session
 from hdx.utilities.uuid import is_valid_uuid
 
 import hdx.api.utilities.url_utils
@@ -755,6 +757,22 @@ class Resource(HDXObject):
             logger.debug(result)
         return resources
 
+    @staticmethod
+    def _get_safe_filename(filename: str) -> str:
+        """Strip any directory components (/ or \\) from a filename built from
+        resource metadata so downloads cannot be written outside the folder
+
+        Args:
+            filename: Filename to make safe
+
+        Returns:
+            Filename without directory components
+        """
+        safe_filename = PureWindowsPath(filename).name
+        if safe_filename in ("", ".", ".."):
+            raise HDXError(f"Invalid filename {filename} for download!")
+        return safe_filename
+
     def _download_file(
         self,
         url: str,
@@ -773,7 +791,17 @@ class Resource(HDXObject):
         Returns:
             Path to downloaded file
         """
-        session = hdx.api.utilities.url_utils.get_ckan_ready_session(self.configuration)
+        # Only send the HDX API key to the HDX site, not to external resource URLs
+        hdx_site_url = self.configuration.get_hdx_site_url()
+        if urlsplit(url)[:2] == urlsplit(hdx_site_url)[:2]:
+            session = hdx.api.utilities.url_utils.get_ckan_ready_session(
+                self.configuration
+            )
+        else:
+            session = get_session(
+                full_agent=self.configuration.get_user_agent(), use_env=False
+            )
+        filename = self._get_safe_filename(filename)
         with Download(session=session) as downloader:
             if retriever:
                 downloader = retriever.clone(downloader)

{hdx_python_api-6.7.5.dist-info → hdx_python_api-6.7.6.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hdx-python-api
-Version: 6.7.5
+Version: 6.7.6
 Summary: HDX Python API for interacting with the Humanitarian Data Exchange
 Project-URL: Homepage, https://github.com/OCHA-DAP/hdx-python-api
 Author: Michael Rans
@@ -28,8 +28,8 @@ Requires-Python: >=3.10
 Requires-Dist: ckanapi>=4.11
 Requires-Dist: defopt>=7.0.0
 Requires-Dist: email-validator
-Requires-Dist: hdx-python-country>=4.2.4
-Requires-Dist: hdx-python-utilities>=4.2.3
+Requires-Dist: hdx-python-country>=4.2.5
+Requires-Dist: hdx-python-utilities>=4.2.4
 Requires-Dist: makefun
 Requires-Dist: requests
 Provides-Extra: docs

{hdx_python_api-6.7.5.dist-info → hdx_python_api-6.7.6.dist-info}/RECORD

@@ -1,5 +1,5 @@
 hdx/api/__init__.py,sha256=11ozJKiUsqDCZ3_mcAHhGYUyGK_Unl54djVSBBExFB4,59
-hdx/api/_version.py,sha256=COiFxfgYaSnJUzlrh0vxGDx6Wn8d0Gbr-1uNuoVlOao,520
+hdx/api/_version.py,sha256=jJYFyK64B9LC3RE_aJfCOKY0MSwY3pwsvMideYtT6v4,520
 hdx/api/configuration.py,sha256=9WvuVI-3th2Dv70_t_4VoyrlJwB_9qUSN5_zUKbp4sQ,23805
 hdx/api/hdx_base_configuration.yaml,sha256=jj2t5b7NnI499rHVwOjj3Q5BAjE8i7NDGVKnWZ5P5-4,2222
 hdx/api/locations.py,sha256=bFl_cKz_AEQzkE_xWOkrRlUQ0GT2LMPSk-G_LsbV-Ns,4099
@@ -17,7 +17,7 @@ hdx/data/dataset.py,sha256=-GQO08PK8u19O0qRWttg3AuPskPCwjffcE2mPq-7dQE,105903
 hdx/data/hdxobject.py,sha256=EG5KkVpi-yF6m6HVF79EqDneq1W7mo5M-bPJHG79T0I,28383
 hdx/data/location.py,sha256=UJPGKc8euAYFJsUFkdQtViLUwqNWYOWwaLELApAMHk4,11168
 hdx/data/organization.py,sha256=IRen2F2NsXLC8r-PVTS9eQp7LTn_44OcDUa1S7SCKiQ,13140
-hdx/data/resource.py,sha256=QDQJp7XoCDn9DmyWPgA2YCn8Z4HGwezEkFyae_YlFKI,56507
+hdx/data/resource.py,sha256=XgYDGD5mYc89uaiRi0oamVJ5FTFSOV6QO_Nx-9_rjpo,57601
 hdx/data/resource_matcher.py,sha256=Yzk9pWa4zk1p09m6zcZMj0XZf5Y16Pa3KToOdUt7rP8,4247
 hdx/data/resource_view.py,sha256=GcYkh0iDAe6_m2ErY_A6i3Z7ZFX949eGt1TLnLZv_8s,7346
 hdx/data/showcase.py,sha256=vnRZ45xd9Ct65eFQkWZtMIJPFifZfKOrH4obO5D5Pvc,14062
@@ -27,7 +27,7 @@ hdx/facades/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 hdx/facades/infer_arguments.py,sha256=DvyDuozfOPmoaV7HjhQySojGIrMWW9nos31auQBVVl8,4032
 hdx/facades/keyword_arguments.py,sha256=aVapHCfqBO6H7xxBgTdK9ISdgrBFsNypPDWihfQ3edU,1125
 hdx/facades/simple.py,sha256=QWsBkaHG_UM6X3Zu2u3LWVOQzeR24q-EUClrfsL_mkM,1064
-hdx_python_api-6.7.5.dist-info/METADATA,sha256=C2mT_Q4SPSXjrlmzR_lHKSCdrO4YwxJPaMFHgsVcHHc,4946
-hdx_python_api-6.7.5.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-hdx_python_api-6.7.5.dist-info/licenses/LICENSE,sha256=wc-4GpMn-ODs-U_bTe1YCiPVgvcjzrpYOx2wPuyAeII,1079
-hdx_python_api-6.7.5.dist-info/RECORD,,
+hdx_python_api-6.7.6.dist-info/METADATA,sha256=_qNCZVzLKXdxqpPobApEMa5cuFJGeF0161_44-L01vM,4946
+hdx_python_api-6.7.6.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+hdx_python_api-6.7.6.dist-info/licenses/LICENSE,sha256=wc-4GpMn-ODs-U_bTe1YCiPVgvcjzrpYOx2wPuyAeII,1079
+hdx_python_api-6.7.6.dist-info/RECORD,,