mlrun 1.10.0rc20__tar.gz → 1.10.0rc21__tar.gz

{mlrun-1.10.0rc20/mlrun.egg-info → mlrun-1.10.0rc21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mlrun
-Version: 1.10.0rc20
+Version: 1.10.0rc21
 Summary: Tracking and config of machine learning runs
 Home-page: https://github.com/mlrun/mlrun
 Author: Yaron Haviv
@@ -21,7 +21,8 @@ Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.9, <3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: urllib3<1.27,>=1.26.9
+Requires-Dist: urllib3>=1.26.20; python_version < "3.11"
+Requires-Dist: urllib3>=2.5.0; python_version >= "3.11"
 Requires-Dist: GitPython>=3.1.41,~=3.1
 Requires-Dist: aiohttp~=3.11
 Requires-Dist: aiohttp-retry~=2.9

{mlrun-1.10.0rc20 → mlrun-1.10.0rc21}/mlrun/run.py

@@ -141,7 +141,7 @@ def load_func_code(command="", workdir=None, secrets=None, name="name"):
         else:
             is_remote = "://" in command
             data = get_object(command, secrets)
-            runtime = yaml.load(data, Loader=yaml.FullLoader)
+            runtime = yaml.safe_load(data)
             runtime = new_function(runtime=runtime)
 
         command = runtime.spec.command or ""
@@ -362,7 +362,10 @@ def import_function(url="", secrets=None, db="", project=None, new_name=None):
     return function
 
 
-def import_function_to_dict(url, secrets=None):
+def import_function_to_dict(
+    url: str,
+    secrets: Optional[dict] = None,
+) -> dict:
     """Load function spec from local/remote YAML file"""
     obj = get_object(url, secrets)
     runtime = yaml.safe_load(obj)
@@ -388,6 +391,11 @@ def import_function_to_dict(url, secrets=None):
                 raise ValueError("exec path (spec.command) must be relative")
             url = url[: url.rfind("/") + 1] + code_file
             code = get_object(url, secrets)
+            code_file = _ensure_path_confined_to_base_dir(
+                base_directory=".",
+                relative_path=code_file,
+                error_message_on_escape="Path traversal detected in spec.command",
+            )
             dir = path.dirname(code_file)
             if dir:
                 makedirs(dir, exist_ok=True)
@@ -395,9 +403,16 @@ def import_function_to_dict(url, secrets=None):
                 fp.write(code)
         elif cmd:
             if not path.isfile(code_file):
-                # look for the file in a relative path to the yaml
-                slash = url.rfind("/")
-                if slash >= 0 and path.isfile(url[: url.rfind("/") + 1] + code_file):
+                slash_index = url.rfind("/")
+                if slash_index < 0:
+                    raise ValueError(f"no file in exec path (spec.command={code_file})")
+                base_dir = os.path.normpath(url[: slash_index + 1])
+                candidate_path = _ensure_path_confined_to_base_dir(
+                    base_directory=base_dir,
+                    relative_path=code_file,
+                    error_message_on_escape=f"exec file spec.command={code_file} is outside of allowed directory",
+                )
+                if path.isfile(candidate_path):
                     raise ValueError(
                         f"exec file spec.command={code_file} is relative, change working dir"
                     )
@@ -1258,3 +1273,21 @@ def wait_for_runs_completion(
         runs = running
 
     return completed
+
+
+def _ensure_path_confined_to_base_dir(
+    base_directory: str,
+    relative_path: str,
+    error_message_on_escape: str,
+) -> str:
+    """
+    Join `user_supplied_relative_path` to `allowed_base_directory`, normalise the result,
+    and guarantee it stays inside `allowed_base_directory`.
+    """
+    absolute_base_directory = path.abspath(base_directory)
+    absolute_candidate_path = path.abspath(
+        path.join(absolute_base_directory, relative_path)
+    )
+    if not absolute_candidate_path.startswith(absolute_base_directory + path.sep):
+        raise ValueError(error_message_on_escape)
+    return absolute_candidate_path

mlrun-1.10.0rc21/mlrun/utils/version/version.json

@@ -0,0 +1,4 @@
+{
+  "git_commit": "af3bd0907729d21274b7bb80cfbf8671016fb875",
+  "version": "1.10.0-rc21"
+}

{mlrun-1.10.0rc20 → mlrun-1.10.0rc21/mlrun.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mlrun
-Version: 1.10.0rc20
+Version: 1.10.0rc21
 Summary: Tracking and config of machine learning runs
 Home-page: https://github.com/mlrun/mlrun
 Author: Yaron Haviv
@@ -21,7 +21,8 @@ Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.9, <3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: urllib3<1.27,>=1.26.9
+Requires-Dist: urllib3>=1.26.20; python_version < "3.11"
+Requires-Dist: urllib3>=2.5.0; python_version >= "3.11"
 Requires-Dist: GitPython>=3.1.41,~=3.1
 Requires-Dist: aiohttp~=3.11
 Requires-Dist: aiohttp-retry~=2.9

{mlrun-1.10.0rc20 → mlrun-1.10.0rc21}/mlrun.egg-info/requires.txt

@@ -1,4 +1,3 @@
-urllib3<1.27,>=1.26.9
 GitPython>=3.1.41,~=3.1
 aiohttp~=3.11
 aiohttp-retry~=2.9
@@ -32,9 +31,11 @@ docstring_parser~=0.16
 aiosmtplib~=3.0
 
 [:python_version < "3.11"]
+urllib3>=1.26.20
 v3io-frames~=0.10.14
 
 [:python_version >= "3.11"]
+urllib3>=2.5.0
 v3io-frames>=0.13.0
 
 [alibaba-oss]

{mlrun-1.10.0rc20 → mlrun-1.10.0rc21}/requirements.txt

@@ -1,5 +1,6 @@
 # >=1.28.0,<1.29.0 botocore inside boto3 1.28.17 inside nuclio-jupyter 0.9.13
-urllib3>=1.26.9, <1.27
+urllib3>=1.26.20; python_version < "3.11"
+urllib3>=2.5.0; python_version >= "3.11"
 GitPython~=3.1, >=3.1.41
 aiohttp~=3.11
 aiohttp-retry~=2.9

{mlrun-1.10.0rc20 → mlrun-1.10.0rc21}/setup.py

@@ -59,7 +59,12 @@ setup(
             "server",
         ]
     ),
-    package_data={"mlrun": ["runtimes/nuclio/application/*.go"]},
+    package_data={
+        "mlrun": [
+            "utils/version/version.json",
+            "runtimes/nuclio/application/*.go",
+        ]
+    },
     keywords=[
         "mlrun",
         "mlops",

mlrun-1.10.0rc20/mlrun/utils/version/version.json

@@ -1,4 +0,0 @@
-{
-  "git_commit": "bf47f85a95ed8a3d2d4143cb931b2f0b16b5cdbd",
-  "version": "1.10.0-rc20"
-}