mcli-framework 8.0.49__tar.gz → 8.0.50__tar.gz

{mcli_framework-8.0.49/src/mcli_framework.egg-info → mcli_framework-8.0.50}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcli-framework
-Version: 8.0.49
+Version: 8.0.50
 Summary: Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job.
 Author-email: Luis Fernandez de la Vara <luis@lefv.io>
 Maintainer-email: Luis Fernandez de la Vara <luis@lefv.io>

{mcli_framework-8.0.49 → mcli_framework-8.0.50}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcli-framework"
-version = "8.0.49"
+version = "8.0.50"
 description = "Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job."
 readme = "README.md"
  requires-python = ">=3.10"

{mcli_framework-8.0.49 → mcli_framework-8.0.50}/src/mcli/lib/ipfs_sync.py

@@ -28,7 +28,7 @@ import hashlib
 import json
 import time
 from datetime import datetime
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 from typing import Optional
 
 import requests
@@ -535,7 +535,19 @@ class IPFSSync:
                         f"hash mismatch for '{name}': expected {expected_value}, got {actual}"
                     )
 
-            target = workflows_dir / script_filename
+            # SECURITY: `script_filename` comes from a remote, untrusted manifest.
+            # Contain it inside workflows_dir so a crafted manifest cannot write
+            # outside the directory via '..' segments or an absolute path.
+            rel = PurePosixPath(script_filename)
+            if rel.is_absolute() or any(part == ".." for part in rel.parts):
+                raise ValueError(f"unsafe script path in manifest: {script_filename}")
+            base = Path(workflows_dir).resolve()
+            target = (base / Path(*rel.parts)).resolve()
+            if base != target and base not in target.parents:
+                raise ValueError(f"script path escapes workflows dir: {script_filename}")
+
+            # Recreate group subdirectories (e.g. "demo/hello.py") on pull.
+            target.parent.mkdir(parents=True, exist_ok=True)
             target.write_bytes(payload)
             written.append(target)
 

{mcli_framework-8.0.49 → mcli_framework-8.0.50/src/mcli_framework.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcli-framework
-Version: 8.0.49
+Version: 8.0.50
 Summary: Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job.
 Author-email: Luis Fernandez de la Vara <luis@lefv.io>
 Maintainer-email: Luis Fernandez de la Vara <luis@lefv.io>