lean-runtime 2.0.2__tar.gz → 2.0.3__tar.gz

{lean_runtime-2.0.2 → lean_runtime-2.0.3}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 2.0.3
+
+- Accept portable-copy symlinks whose normalized targets remain inside the
+  extracted copy, including common links such as `docs/README.md -> ../README.md`.
+- Continue rejecting absolute or escaping symlink targets, duplicate archive
+  members, and later archive writes that traverse an extracted symlink.
+
 ## 2.0.2
 
 - Remove staged environments safely when Git-for-Windows leaves source pack

{lean_runtime-2.0.2/lean_runtime.egg-info → lean_runtime-2.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lean-runtime
-Version: 2.0.2
+Version: 2.0.3
 Summary: Run Lean 4 proofs from Python or standalone files
 Author: Alejandro Radisic
 License-Expression: Apache-2.0

{lean_runtime-2.0.2 → lean_runtime-2.0.3}/lean_runtime/bundles.py

@@ -203,11 +203,54 @@ def _require_media_type(descriptor: dict[str, Any], expected: str, label: str) -
 
 def _safe_name(name: str) -> PurePosixPath:
     path = PurePosixPath(name)
-    if not name or path.is_absolute() or ".." in path.parts or "\x00" in name:
+    if (
+        not name
+        or path == PurePosixPath(".")
+        or path.is_absolute()
+        or ".." in path.parts
+        or "\\" in name
+        or "\x00" in name
+    ):
         raise EnvironmentError(f"unsafe bundle member path: {name!r}")
     return path
 
 
+def _internal_link_target(member: PurePosixPath, linkname: str) -> PurePosixPath:
+    link = PurePosixPath(linkname)
+    if not linkname or link.is_absolute() or "\\" in linkname or "\x00" in linkname:
+        raise EnvironmentError(f"unsafe bundle symlink: {member.as_posix()!r}")
+    parts: list[str] = []
+    for part in member.parent.joinpath(link).parts:
+        if part in {"", "."}:
+            continue
+        if part == "..":
+            if not parts:
+                raise EnvironmentError(f"unsafe bundle symlink: {member.as_posix()!r}")
+            parts.pop()
+        else:
+            parts.append(part)
+    return PurePosixPath(*parts) if parts else PurePosixPath(".")
+
+
+def _ensure_directories(destination: Path, relative: PurePosixPath) -> None:
+    current = destination
+    for part in relative.parts:
+        if part == ".":
+            continue
+        current = current / part
+        if current.is_symlink():
+            raise EnvironmentError(
+                f"bundle member traverses an extracted symlink: {relative.as_posix()!r}"
+            )
+        if current.exists():
+            if not current.is_dir():
+                raise EnvironmentError(
+                    f"bundle member parent is not a directory: {relative.as_posix()!r}"
+                )
+        else:
+            current.mkdir()
+
+
 def _packages_directory(lock: EnvironmentLock) -> PurePosixPath:
     value = lock.manifest.get("packagesDir", ".lake/packages")
     if not isinstance(value, str):
@@ -221,6 +264,8 @@ def _packages_directory(lock: EnvironmentLock) -> PurePosixPath:
 def _extract_layer(data: bytes | Path, destination: Path) -> None:
     total = 0
     count = 0
+    if destination.is_symlink():
+        raise EnvironmentError("bundle extraction destination must not be a symlink")
     destination.mkdir(parents=True, exist_ok=True)
     try:
         if isinstance(data, Path):
@@ -240,10 +285,12 @@ def _extract_layer(data: bytes | Path, destination: Path) -> None:
             relative = _safe_name(member.name)
             target = destination.joinpath(*relative.parts)
             if member.isdir():
-                target.mkdir(parents=True, exist_ok=True)
+                _ensure_directories(destination, relative)
                 target.chmod(member.mode & 0o777)
             elif member.isfile():
-                target.parent.mkdir(parents=True, exist_ok=True)
+                _ensure_directories(destination, relative.parent)
+                if target.exists() or target.is_symlink():
+                    raise EnvironmentError(f"duplicate bundle member: {member.name!r}")
                 source = archive.extractfile(member)
                 if source is None:
                     raise EnvironmentError(f"bundle member has no content: {member.name}")
@@ -251,11 +298,10 @@ def _extract_layer(data: bytes | Path, destination: Path) -> None:
                     shutil.copyfileobj(source, handle)
                 target.chmod(member.mode & 0o777)
             elif member.issym():
-                link = PurePosixPath(member.linkname)
-                resolved = relative.parent.joinpath(link)
-                if link.is_absolute() or ".." in resolved.parts:
-                    raise EnvironmentError(f"unsafe bundle symlink: {member.name!r}")
-                target.parent.mkdir(parents=True, exist_ok=True)
+                _internal_link_target(relative, member.linkname)
+                _ensure_directories(destination, relative.parent)
+                if target.exists() or target.is_symlink():
+                    raise EnvironmentError(f"duplicate bundle member: {member.name!r}")
                 target.symlink_to(member.linkname)
             else:
                 raise EnvironmentError(f"unsupported bundle member: {member.name!r}")

{lean_runtime-2.0.2 → lean_runtime-2.0.3/lean_runtime.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lean-runtime
-Version: 2.0.2
+Version: 2.0.3
 Summary: Run Lean 4 proofs from Python or standalone files
 Author: Alejandro Radisic
 License-Expression: Apache-2.0

{lean_runtime-2.0.2 → lean_runtime-2.0.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "lean-runtime"
-version = "2.0.2"
+version = "2.0.3"
 description = "Run Lean 4 proofs from Python or standalone files"
 readme = "README.md"
 requires-python = ">=3.10"

{lean_runtime-2.0.2 → lean_runtime-2.0.3}/tests/test_bundles.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import hashlib
 import http.server
+import io
 import json
 import os
 import shutil
@@ -15,7 +16,7 @@ from pathlib import Path
 import pytest
 
 from lean_runtime import EnvironmentError, EnvironmentLock, LockedPackage, Runtime
-from lean_runtime.bundles import _oci_archive
+from lean_runtime.bundles import _extract_layer, _oci_archive
 from lean_runtime.environments import ENVIRONMENT_SCHEMA
 from lean_runtime.oci import OCIEnvironmentPublisher, OCIRepository
 from lean_runtime.store import environment_identity, platform_record, source_snapshot_digest
@@ -119,6 +120,57 @@ def _archive_entries(path: Path) -> dict[str, bytes]:
     return result
 
 
+def _layer(*members: tuple[str, str, bytes | str]) -> bytes:
+    output = io.BytesIO()
+    with tarfile.open(fileobj=output, mode="w:gz", format=tarfile.PAX_FORMAT) as archive:
+        for kind, name, value in members:
+            info = tarfile.TarInfo(name)
+            info.mode = 0o644
+            if kind == "file":
+                assert isinstance(value, bytes)
+                info.size = len(value)
+                archive.addfile(info, io.BytesIO(value))
+            else:
+                assert kind == "symlink" and isinstance(value, str)
+                info.type = tarfile.SYMTYPE
+                info.linkname = value
+                archive.addfile(info)
+    return output.getvalue()
+
+
+@pytest.mark.skipif(os.name == "nt", reason="Windows runners may not permit symlink creation")
+def test_layer_extract_accepts_internal_parent_symlink(tmp_path: Path) -> None:
+    layer = _layer(
+        ("file", "README.md", b"Batteries\n"),
+        ("symlink", "docs/README.md", "../README.md"),
+    )
+
+    _extract_layer(layer, tmp_path / "output")
+
+    link = tmp_path / "output" / "docs" / "README.md"
+    assert link.is_symlink()
+    assert link.read_text() == "Batteries\n"
+
+
+@pytest.mark.skipif(os.name == "nt", reason="Windows runners may not permit symlink creation")
+def test_layer_extract_rejects_symlink_outside_destination(tmp_path: Path) -> None:
+    layer = _layer(("symlink", "docs/README.md", "../../outside"))
+
+    with pytest.raises(EnvironmentError, match="unsafe bundle symlink"):
+        _extract_layer(layer, tmp_path / "output")
+
+
+@pytest.mark.skipif(os.name == "nt", reason="Windows runners may not permit symlink creation")
+def test_layer_extract_rejects_later_write_through_symlink(tmp_path: Path) -> None:
+    layer = _layer(
+        ("symlink", "redirect", "inside"),
+        ("file", "redirect/payload", b"must not be written"),
+    )
+
+    with pytest.raises(EnvironmentError, match="traverses an extracted symlink"):
+        _extract_layer(layer, tmp_path / "output")
+
+
 def test_bundle_export_is_deterministic_and_imports_into_fresh_store(tmp_path: Path) -> None:
     producer, environment_id, lock = _published_runtime(tmp_path / "producer")
     first = tmp_path / "first.oci.tar.gz"