python-fsutil 0.16.0__tar.gz → 0.17.0__tar.gz

{python_fsutil-0.16.0/src/python_fsutil.egg-info → python_fsutil-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-fsutil
-Version: 0.16.0
+Version: 0.17.0
 Summary: high-level file-system operations for lazy devs.
 Author-email: Fabio Caccamo <fabio.caccamo@gmail.com>
 Maintainer-email: Fabio Caccamo <fabio.caccamo@gmail.com>
@@ -69,6 +69,7 @@ Dynamic: license-file
 [![](https://img.shields.io/codacy/grade/fc40788ae7d74d1fb34a38934113c4e5?logo=codacy)](https://www.codacy.com/app/fabiocaccamo/python-fsutil)
 [![](https://img.shields.io/badge/code%20style-black-000000.svg?logo=python&logoColor=black)](https://github.com/psf/black)
 [![](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fabiocaccamo/python-fsutil/badge)](https://securityscorecards.dev/viewer/?uri=github.com/fabiocaccamo/python-fsutil)
 
 # python-fsutil
 high-level file-system operations for lazy devs.

{python_fsutil-0.16.0 → python_fsutil-0.17.0}/README.md

@@ -10,6 +10,7 @@
 [![](https://img.shields.io/codacy/grade/fc40788ae7d74d1fb34a38934113c4e5?logo=codacy)](https://www.codacy.com/app/fabiocaccamo/python-fsutil)
 [![](https://img.shields.io/badge/code%20style-black-000000.svg?logo=python&logoColor=black)](https://github.com/psf/black)
 [![](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fabiocaccamo/python-fsutil/badge)](https://securityscorecards.dev/viewer/?uri=github.com/fabiocaccamo/python-fsutil)
 
 # python-fsutil
 high-level file-system operations for lazy devs.

{python_fsutil-0.16.0 → python_fsutil-0.17.0}/src/fsutil/converters.py

@@ -11,7 +11,7 @@ def convert_size_bytes_to_string(size: int) -> str:
     units = SIZE_UNITS
     factor = 0
     factor_limit = len(units) - 1
-    while (size_num >= 1024) and (factor <= factor_limit):
+    while (size_num >= 1024) and (factor < factor_limit):
         size_num /= 1024
         factor += 1
     size_units = units[factor]

{python_fsutil-0.16.0 → python_fsutil-0.17.0}/src/fsutil/info.py

@@ -2,7 +2,9 @@ from __future__ import annotations
 
 import hashlib
 import os
+import pathlib
 from datetime import datetime
+from typing import IO
 
 from fsutil.args import get_path as _get_path
 from fsutil.checks import assert_dir, assert_file
@@ -129,17 +131,29 @@ def get_file_creation_date_formatted(
     return date.strftime(format)
 
 
-def get_file_hash(path: PathIn, *, func: str = "md5") -> str:
+def get_file_hash(path: PathIn | IO[bytes], *, func: str = "md5") -> str:
     """
-    Get the hash of the file at the given path using
-    the specified algorithm function (md5 by default).
+    Get the hash of the file at the given path (or of the given
+    binary file-like object) using the specified algorithm
+    function (md5 by default).
     """
-    path = _get_path(path)
-    assert_file(path)
     hash = hashlib.new(func)
-    with open(path, "rb") as file:
-        for chunk in iter(lambda: file.read(4096), b""):
+    if isinstance(path, (str, pathlib.Path)):
+        path = _get_path(path)
+        assert_file(path)
+        with open(path, "rb") as file:
+            for chunk in iter(lambda: file.read(4096), b""):
+                hash.update(chunk)
+    else:
+        fileobj = path
+        position = None
+        if fileobj.seekable():
+            position = fileobj.tell()
+            fileobj.seek(0)
+        for chunk in iter(lambda: fileobj.read(4096), b""):
             hash.update(chunk)
+        if position is not None:
+            fileobj.seek(position)
     hash_hex = hash.hexdigest()
     return hash_hex
 

{python_fsutil-0.16.0 → python_fsutil-0.17.0}/src/fsutil/metadata.py

@@ -4,4 +4,4 @@ __description__ = "high-level file-system operations for lazy devs."
 __email__ = "fabio.caccamo@gmail.com"
 __license__ = "MIT"
 __title__ = "python-fsutil"
-__version__ = "0.16.0"
+__version__ = "0.17.0"

{python_fsutil-0.16.0 → python_fsutil-0.17.0}/src/fsutil/operations.py

@@ -213,7 +213,9 @@ def download_file(
             filename_pattern = r'filename="(.*)"'
             filename_match = re.search(filename_pattern, content_disposition)
             if filename_match:
-                filename = filename_match.group(1)
+                # sanitize Content-Disposition filename to prevent path traversal
+                filename = filename_match.group(1).replace("\\", "/")
+                filename = os.path.basename(filename)
             # or detect filename from url
             if not filename:
                 filename = get_filename(url)
@@ -518,7 +520,9 @@ def _search_paths(path: PathIn, pattern: str) -> list[str]:
     pathname = os.path.join(path, pattern)
     paths = glob.glob(pathname, recursive=True)
     # normalize paths to use OS-specific separators
-    paths = [os.path.normpath(path_result) for path_result in paths]
+    paths = [
+        os.path.relpath(os.path.normpath(path_result), path) for path_result in paths
+    ]
     return paths
 
 

{python_fsutil-0.16.0 → python_fsutil-0.17.0/src/python_fsutil.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-fsutil
-Version: 0.16.0
+Version: 0.17.0
 Summary: high-level file-system operations for lazy devs.
 Author-email: Fabio Caccamo <fabio.caccamo@gmail.com>
 Maintainer-email: Fabio Caccamo <fabio.caccamo@gmail.com>
@@ -69,6 +69,7 @@ Dynamic: license-file
 [![](https://img.shields.io/codacy/grade/fc40788ae7d74d1fb34a38934113c4e5?logo=codacy)](https://www.codacy.com/app/fabiocaccamo/python-fsutil)
 [![](https://img.shields.io/badge/code%20style-black-000000.svg?logo=python&logoColor=black)](https://github.com/psf/black)
 [![](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fabiocaccamo/python-fsutil/badge)](https://securityscorecards.dev/viewer/?uri=github.com/fabiocaccamo/python-fsutil)
 
 # python-fsutil
 high-level file-system operations for lazy devs.

{python_fsutil-0.16.0 → python_fsutil-0.17.0}/tests/test_converters.py

@@ -13,6 +13,9 @@ import fsutil
         (1073741824, "1.00 GB"),
         (1879048192, "1.75 GB"),
         (1099511627776, "1.00 TB"),
+        (2**80, "1.00 YB"),
+        (2**90, "1024.00 YB"),
+        (2**100, "1048576.00 YB"),
     ],
 )
 def test_convert_size_bytes_to_string(size_bytes, expected_output):
@@ -51,6 +54,9 @@ def test_convert_size_bytes_to_string_and_convert_size_string_to_bytes(
         ("1.00 MB", 1048576),
         ("1.00 GB", 1073741824),
         ("1.00 TB", 1099511627776),
+        ("1.00 YB", 2**80),
+        ("1024.00 YB", 2**90),
+        ("1048576.00 YB", 2**100),
     ],
 )
 def test_convert_size_string_to_bytes(size_string, expected_output):
@@ -69,6 +75,9 @@ def test_convert_size_string_to_bytes(size_string, expected_output):
         (1170378588, 1170378588),
         (2136746229, 2136746229),
         (1099511627776, 1099511627776),
+        (2**80, 2**80),
+        (2**90, 2**90),
+        (2**100, 2**100),
     ],
 )
 def test_convert_size_string_to_bytes_and_convert_size_bytes_to_string(

{python_fsutil-0.16.0 → python_fsutil-0.17.0}/tests/test_info.py

@@ -1,3 +1,4 @@
+import io
 import re
 import time
 from datetime import datetime, timedelta
@@ -127,6 +128,20 @@ def test_get_file_hash(temp_path):
     assert file_hash == "b10a8db164e0754105b7a99be72e3fe5"
 
 
+def test_get_file_hash_with_file_like_object():
+    file = io.BytesIO(b"Hello World")
+    file_hash = fsutil.get_file_hash(file)
+    assert file_hash == "b10a8db164e0754105b7a99be72e3fe5"
+
+
+def test_get_file_hash_with_file_like_object_restores_position():
+    file = io.BytesIO(b"Hello World")
+    file.seek(6)
+    file_hash = fsutil.get_file_hash(file)
+    assert file_hash == "b10a8db164e0754105b7a99be72e3fe5"
+    assert file.tell() == 6
+
+
 def test_get_file_last_modified_date(temp_path):
     path = temp_path("a/b/c.txt")
     fsutil.create_file(path, content="Hello")

{python_fsutil-0.16.0 → python_fsutil-0.17.0}/tests/test_operations.py

@@ -232,6 +232,33 @@ def test_download_file_without_requests_installed(temp_path):
             fsutil.download_file(url, dirpath=temp_path())
 
 
+def test_download_file_content_disposition_filename_is_sanitized(temp_path):
+    class MockResponse:
+        headers = {"content-disposition": 'attachment; filename="..\\..\\evil.txt"'}
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, exc_type, exc_val, exc_tb):
+            return None
+
+        def raise_for_status(self):
+            return None
+
+        def iter_content(self, chunk_size=1):
+            yield b"hello world"
+
+    class MockRequests:
+        def get(self, *args, **kwargs):
+            return MockResponse()
+
+    with patch("fsutil.operations.require_requests", return_value=MockRequests()):
+        path = fsutil.download_file("https://example.com/file.txt", dirpath=temp_path())
+        assert fsutil.exists(path)
+        assert fsutil.get_filename(path) == "evil.txt"
+        assert path == temp_path("evil.txt")
+
+
 def test_list_dirs(temp_path):
     for i in range(0, 5):
         fsutil.create_dir(temp_path(f"a/b/c/d-{i}"))
@@ -518,6 +545,24 @@ def test_search_files(temp_path):
     assert results == expected_results
 
 
+def test_search_files_with_relative_path(temp_path, monkeypatch):
+    """
+    Regression test: search_files with a relative path must not return an empty
+    list due to the double-prefix bug in _filter_paths.
+    """
+    fsutil.create_file(temp_path("a/b/c/IMG_1002.png"))
+    fsutil.create_file(temp_path("a/x/c/IMG_1005.png"))
+    fsutil.create_file(temp_path("a/b/c/IMG_1000.jpg"))
+
+    # change cwd to the parent of "a/" so that the relative path is valid
+    monkeypatch.chdir(temp_path(""))
+
+    results = fsutil.search_files("./a/", "**/c/IMG_*.png")
+
+    assert len(results) == 2
+    assert all(fsutil.is_file(result) for result in results)
+
+
 def test_search_dirs(temp_path):
     fsutil.create_file(temp_path("a/b/c/IMG_1000.jpg"))
     fsutil.create_file(temp_path("x/y/z/c/IMG_1001.jpg"))