ostruct-cli 0.8.8__py3-none-any.whl → 1.0.0__py3-none-any.whl

ostruct/cli/security/__init__.py

@@ -19,6 +19,7 @@ from .errors import (
 from .normalization import normalize_path
 from .safe_joiner import safe_join
 from .security_manager import SecurityManager
+from .types import PathSecurity
 
 __all__ = [
     "normalize_path",
@@ -29,4 +30,5 @@ __all__ = [
     "DirectoryNotFoundError",
     "SecurityErrorReasons",
     "SecurityManager",
+    "PathSecurity",
 ]

ostruct/cli/security/allowed_checker.py

@@ -4,11 +4,14 @@ This module provides functionality to verify that a given path is within
 one of a set of allowed directories.
 """
 
+import logging
 from pathlib import Path
 from typing import List, Union
 
 from .normalization import normalize_path
 
+logger = logging.getLogger(__name__)
+
 
 def is_path_in_allowed_dirs(
     path: Union[str, Path], allowed_dirs: List[Path]
@@ -17,6 +20,8 @@ def is_path_in_allowed_dirs(
 
     This function normalizes both the input path and allowed directories
     before comparison to ensure consistent results across platforms.
+    It also handles symlink resolution to ensure that resolved paths
+    can be compared correctly with allowed directories.
 
     Args:
         path: The path to check.
@@ -43,6 +48,7 @@ def is_path_in_allowed_dirs(
     norm_path = normalize_path(path)
     norm_allowed = [normalize_path(d) for d in allowed_dirs]
 
+    # Check with normalized paths first
     for allowed in norm_allowed:
         try:
             # If path.relative_to(allowed) does not raise an error,
@@ -52,4 +58,39 @@ def is_path_in_allowed_dirs(
         except ValueError:
             continue
 
+    # If normalized comparison failed, try with resolved paths
+    # This handles the case where the input path is already resolved (e.g., from validate_file_access)
+    # but the allowed directories are not resolved
+    try:
+        # Check if the input path might already be resolved by comparing it with its own resolution
+        path_as_path = Path(path) if isinstance(path, str) else path
+
+        # If the input path is already resolved, resolve allowed dirs to match
+        # We determine this by checking if the path starts with common temp resolved prefixes
+        path_str = str(path_as_path)
+        if path_str.startswith("/var/folders/") or path_str.startswith(
+            "/private/"
+        ):
+            # This looks like an already-resolved path on macOS, resolve allowed dirs
+            resolved_allowed = [d.resolve() for d in norm_allowed]
+            for allowed in resolved_allowed:
+                try:
+                    path_as_path.relative_to(allowed)
+                    return True
+                except ValueError:
+                    continue
+        else:
+            # Try resolving both path and allowed dirs
+            resolved_path = norm_path.resolve()
+            resolved_allowed = [d.resolve() for d in norm_allowed]
+            for allowed in resolved_allowed:
+                try:
+                    resolved_path.relative_to(allowed)
+                    return True
+                except ValueError:
+                    continue
+    except (OSError, RuntimeError):
+        # If resolution fails, fall back to normalized comparison result
+        pass
+
     return False

ostruct/cli/security/normalization.py

@@ -68,7 +68,9 @@ _BACKSLASH_PATTERN = re.compile(r"\\")
 _MULTIPLE_SLASH_PATTERN = re.compile(r"/+")
 
 
-def normalize_path(path: Union[str, Path]) -> Path:
+def normalize_path(
+    path: Union[str, Path], allow_traversal: bool = False
+) -> Path:
     """Normalize a path string with security checks.
 
     This function:
@@ -94,6 +96,7 @@ def normalize_path(path: Union[str, Path]) -> Path:
 
     Args:
         path: A string or Path object representing a file path.
+        allow_traversal: If True, allow ".." components in paths (for explicitly allowed files).
 
     Returns:
         A pathlib.Path object for the normalized absolute path.
@@ -132,14 +135,15 @@ def normalize_path(path: Union[str, Path]) -> Path:
     if match := _UNICODE_SAFETY_PATTERN.search(normalized):
         matched_text = match.group(0)
         if ".." in matched_text:
-            raise PathSecurityError(
-                "Directory traversal not allowed",
-                path=path_str,
-                context={
-                    "reason": SecurityErrorReasons.PATH_TRAVERSAL,
-                    "matched": matched_text,
-                },
-            )
+            if not allow_traversal:
+                raise PathSecurityError(
+                    "Directory traversal not allowed",
+                    path=path_str,
+                    context={
+                        "reason": SecurityErrorReasons.PATH_TRAVERSAL,
+                        "matched": matched_text,
+                    },
+                )
         else:
             raise PathSecurityError(
                 "Path contains unsafe characters",