portolan-python 0.1.2__tar.gz → 0.1.3__tar.gz

{portolan_python-0.1.2 → portolan_python-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: portolan-python
-Version: 0.1.2
+Version: 0.1.3
 Summary: A lightweight Python implementation of the Portolan specification.
 Author: Portolan contributors
 License: Apache-2.0

{portolan_python-0.1.2 → portolan_python-0.1.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "portolan-python"
-version = "0.1.2"
+version = "0.1.3"
 description = "A lightweight Python implementation of the Portolan specification."
 readme = "README.md"
 requires-python = ">=3.10"

{portolan_python-0.1.2 → portolan_python-0.1.3}/src/portolan/registry.py

@@ -56,7 +56,7 @@ def load_registry_entries(
         entries.append(
             RegistryCatalogEntry(
                 id=registry_id,
-                url=href,
+                url=urljoin(registry_url, href),
                 title=title if isinstance(title, str) else None,
                 status=status if isinstance(status, str) else None,
             )
@@ -107,13 +107,19 @@ def _write_catalog_tree(
     output_root: Path,
     fetch_json: Callable[[str], JsonObject],
     visited: set[str] | None = None,
+    targets: dict[Path, str] | None = None,
 ) -> None:
     if visited is None:
         visited = set()
+    if targets is None:
+        targets = {}
     visited.add(document_url)
 
-    relative_path = _relative_document_path(root_url, document_url)
-    target = output_root / relative_path
+    target = _target_document_path(root_url, document_url, output_root)
+    owner = targets.get(target)
+    if owner is not None and owner != document_url:
+        raise ValueError(f"Registry documents map to the same local path: {owner}, {document_url}")
+    targets[target] = document_url
     target.parent.mkdir(parents=True, exist_ok=True)
     if document.get("type") == "Collection":
         document = _with_absolute_asset_hrefs(document_url, document)
@@ -128,9 +134,23 @@ def _write_catalog_tree(
         child_url = urljoin(document_url, href)
         if child_url in visited:
             continue
+        child_target = _target_document_path(root_url, child_url, output_root)
+        owner = targets.get(child_target)
+        if owner is not None and owner != child_url:
+            raise ValueError(
+                f"Registry documents map to the same local path: {owner}, {child_url}"
+            )
         child = fetch_json(child_url)
         if child.get("type") in {"Catalog", "Collection"}:
-            _write_catalog_tree(child_url, child, root_url, output_root, fetch_json, visited)
+            _write_catalog_tree(
+                child_url,
+                child,
+                root_url,
+                output_root,
+                fetch_json,
+                visited,
+                targets,
+            )
 
 
 def _with_absolute_asset_hrefs(document_url: str, collection: JsonObject) -> JsonObject:
@@ -155,13 +175,31 @@ def _with_absolute_asset_hrefs(document_url: str, collection: JsonObject) -> Jso
 
 
 def _relative_document_path(root_url: str, document_url: str) -> Path:
-    root_path = Path(urlparse(root_url).path).parent
-    document_path = Path(urlparse(document_url).path)
+    root = urlparse(root_url)
+    document = urlparse(document_url)
+    if (document.scheme.lower(), document.netloc.lower()) != (
+        root.scheme.lower(),
+        root.netloc.lower(),
+    ):
+        raise ValueError(f"Child document has a different origin: {document_url}")
+    root_path = Path(root.path).parent
+    document_path = Path(document.path)
     try:
-        relative = document_path.relative_to(root_path)
-    except ValueError:
-        return Path(document_path.name or "catalog.json")
-    return relative
+        relative_path = document_path.relative_to(root_path)
+    except ValueError as err:
+        raise ValueError(f"Child document is outside catalog root: {document_url}") from err
+    if ".." in relative_path.parts:
+        raise ValueError(f"Child document is outside catalog root: {document_url}")
+    return relative_path
+
+
+def _target_document_path(root_url: str, document_url: str, output_root: Path) -> Path:
+    relative_path = _relative_document_path(root_url, document_url)
+    resolved_root = output_root.resolve()
+    target = (output_root / relative_path).resolve()
+    if not target.is_relative_to(resolved_root):
+        raise ValueError(f"Child document escapes catalog root: {document_url}")
+    return target
 
 
 def _fallback_catalog_id(catalog_url: str) -> str:

{portolan_python-0.1.2 → portolan_python-0.1.3}/tests/test_registry_api.py

@@ -57,6 +57,26 @@ def test_load_registry_entries_filters_to_valid_children() -> None:
     ]
 
 
+def test_load_registry_entries_resolves_relative_child_urls() -> None:
+    registry = {
+        "links": [
+            {
+                "rel": "child",
+                "href": "../demo/catalog.json",
+                "portolan_registry:id": "demo",
+                "portolan_registry:status": "valid",
+            }
+        ]
+    }
+
+    entries = load_registry_entries(
+        "https://registry.test/exports/catalogs.json",
+        fetch_json=lambda url: registry,
+    )
+
+    assert entries[0].url == "https://registry.test/demo/catalog.json"
+
+
 def test_load_registry_entries_supports_catalog_ids_include_stale_and_limit() -> None:
     registry = {
         "links": [
@@ -196,6 +216,94 @@ def test_download_registry_catalog_skips_child_cycles(tmp_path: Path) -> None:
     assert fetched_urls == [root_url, child_url]
 
 
+@pytest.mark.parametrize(
+    ("child_url", "message"),
+    [
+        ("https://other.test/demo/collection.json", "different origin"),
+        ("https://example.test/demo/../../outside.json", "outside catalog root"),
+    ],
+)
+def test_download_registry_catalog_rejects_unsafe_child_urls_before_fetch(
+    child_url: str,
+    message: str,
+    tmp_path: Path,
+) -> None:
+    root_url = "https://example.test/demo/catalog.json"
+    catalog = {
+        "type": "Catalog",
+        "id": "demo",
+        "links": [{"rel": "child", "href": child_url}],
+    }
+    fetched_urls: list[str] = []
+
+    def fetch_json(url: str) -> dict[str, Any]:
+        fetched_urls.append(url)
+        if url != root_url:
+            raise AssertionError(f"Fetched unsafe child URL: {url}")
+        return catalog
+
+    with pytest.raises(ValueError, match=message):
+        download_registry_catalog(root_url, tmp_path, fetch_json=fetch_json)
+
+    assert fetched_urls == [root_url]
+
+
+def test_download_registry_catalog_rejects_symlink_escape(tmp_path: Path) -> None:
+    root_url = "https://example.test/demo/catalog.json"
+    child_url = "https://example.test/demo/linked/collection.json"
+    output_dir = tmp_path / "output"
+    outside_dir = tmp_path / "outside"
+    catalog_root = output_dir / "demo"
+    outside_dir.mkdir()
+    catalog_root.mkdir(parents=True)
+    (catalog_root / "linked").symlink_to(outside_dir, target_is_directory=True)
+    responses = {
+        root_url: {
+            "type": "Catalog",
+            "id": "demo",
+            "links": [{"rel": "child", "href": child_url}],
+        },
+        child_url: _collection("linked", {}),
+    }
+
+    with pytest.raises(ValueError, match="escapes catalog root"):
+        download_registry_catalog(
+            root_url,
+            output_dir,
+            fetch_json=lambda url: responses[url],
+        )
+
+    assert not (outside_dir / "collection.json").exists()
+
+
+def test_download_registry_catalog_rejects_local_path_collisions(tmp_path: Path) -> None:
+    root_url = "https://example.test/demo/catalog.json"
+    first_url = "https://example.test/demo/collection.json?version=1"
+    second_url = "https://example.test/demo/collection.json?version=2"
+    responses = {
+        root_url: {
+            "type": "Catalog",
+            "id": "demo",
+            "links": [
+                {"rel": "child", "href": first_url},
+                {"rel": "child", "href": second_url},
+            ],
+        },
+        first_url: _collection("first", {}),
+        second_url: _collection("second", {}),
+    }
+    fetched_urls: list[str] = []
+
+    def fetch_json(url: str) -> dict[str, Any]:
+        fetched_urls.append(url)
+        return responses[url]
+
+    with pytest.raises(ValueError, match="same local path"):
+        download_registry_catalog(root_url, tmp_path, fetch_json=fetch_json)
+
+    assert fetched_urls == [root_url, first_url]
+
+
 def test_download_registry_catalog_recurses_nested_catalogs_and_uses_fallback_id(
     tmp_path: Path,
 ) -> None:

{portolan_python-0.1.2 → portolan_python-0.1.3}/uv.lock

@@ -468,7 +468,7 @@ wheels = [
 
 [[package]]
 name = "portolan-python"
-version = "0.1.2"
+version = "0.1.3"
 source = { editable = "." }
 
 [package.optional-dependencies]