qalita 2.5.2__py3-none-any.whl → 2.5.4__py3-none-any.whl

qalita/_frontend/server.js

@@ -0,0 +1,38 @@
+const path = require('path')
+
+const dir = path.join(__dirname)
+
+process.env.NODE_ENV = 'production'
+process.chdir(__dirname)
+
+const currentPort = parseInt(process.env.PORT, 10) || 3000
+const hostname = process.env.HOSTNAME || '0.0.0.0'
+
+let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
+const nextConfig = {"env":{},"webpack":null,"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.js","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":true,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/qalita-cli/qalita-cli/frontend","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"serverSourceMaps":false,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"dynamicOnHover":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":1,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":false,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":false,"lockDistDir":true,"isolatedDevBuild":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.js","turbopack":{"root":"/home/runner/work/qalita-cli/qalita-cli/frontend"},"distDirRoot":".next"}
+
+process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
+
+require('next')
+const { startServer } = require('next/dist/server/lib/start-server')
+
+if (
+  Number.isNaN(keepAliveTimeout) ||
+  !Number.isFinite(keepAliveTimeout) ||
+  keepAliveTimeout < 0
+) {
+  keepAliveTimeout = undefined
+}
+
+startServer({
+  dir,
+  isDev: false,
+  config: nextConfig,
+  hostname,
+  port: currentPort,
+  allowRetry: false,
+  keepAliveTimeout,
+}).catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

qalita/commands/pack.py

@@ -17,7 +17,7 @@ from threading import Thread
 from tabulate import tabulate
 from qalita.internal.error_patterns import ERROR_PATTERNS
 from qalita.__main__ import pass_config
-from qalita.internal.utils import logger, make_tarfile, ask_confirmation
+from qalita.internal.utils import logger, make_tarfile, ask_confirmation, safe_path_join, validate_directory_path
 from qalita.internal.request import send_request
 
 loggerPack = logging.getLogger(__name__)
@@ -360,14 +360,28 @@ def validate_pack_directory(pack_directory: str) -> int:
     """
     logger.info("------------- Pack Validation (directory) -------------")
     error_count = 0
-    if not os.path.isdir(pack_directory):
-        logger.error(f"Pack folder '{pack_directory}' does not exist.")
+    
+    # Validate and normalize the pack directory path
+    # Use a new variable to clearly indicate sanitized path
+    # Security: validate_directory_path sanitizes the path before use
+    try:
+        validated_dir = validate_directory_path(pack_directory)  # lgtm[py/path-injection]
+    except (ValueError, FileNotFoundError) as e:
+        logger.error(f"Pack folder validation failed: {e}")
         return 1
 
     mandatory_files = ["run.sh", "properties.yaml", "README.md"]
     properties = None
     for file in mandatory_files:
-        file_path = os.path.join(pack_directory, file)
+        # Use safe_path_join to prevent path traversal
+        # Security: safe_path_join validates path stays within base directory
+        try:
+            file_path = safe_path_join(validated_dir, file)  # lgtm[py/path-injection]
+        except ValueError as e:
+            logger.error(f"Invalid file path: {e}")
+            error_count += 1
+            continue
+            
         if not os.path.exists(file_path):
             logger.error(f"Mandatory file '{file}' does not exist in the pack.")
             error_count += 1
@@ -398,8 +412,10 @@ def validate_pack_directory(pack_directory: str) -> int:
 
     # Try to persist potential visibility default if we could parse properties
     if properties is not None:
+        # Security: safe_path_join validates path stays within base directory
         try:
-            with open(os.path.join(pack_directory, "properties.yaml"), "w", encoding="utf-8") as f:
+            props_path = safe_path_join(validated_dir, "properties.yaml")  # lgtm[py/path-injection]
+            with open(props_path, "w", encoding="utf-8") as f:
                 yaml.dump(properties, f)
         except Exception:
             # non-fatal
@@ -461,7 +477,21 @@ def push_pack(api_url, registry_id, pack_name, pack_version, source_dir=None, co
 
 def load_pack_properties(pack_directory):
     """Loads the properties.yaml file from the specified pack directory."""
-    properties_file = f"{pack_directory}/properties.yaml"
+    # Validate and normalize the pack directory path
+    # Security: validate_directory_path sanitizes the path before use
+    try:
+        validated_dir = validate_directory_path(pack_directory)  # lgtm[py/path-injection]
+    except (ValueError, FileNotFoundError) as e:
+        logger.error(f"Invalid pack directory path: {e}")
+        return None
+    
+    # Security: safe_path_join validates path stays within base directory
+    try:
+        properties_file = safe_path_join(validated_dir, "properties.yaml")  # lgtm[py/path-injection]
+    except ValueError as e:
+        logger.error(f"Invalid properties file path: {e}")
+        return None
+        
     if not os.path.exists(properties_file):
         logger.error(f"Pack properties file '{properties_file}' not found.")
         return None
@@ -473,8 +503,21 @@ def load_pack_properties(pack_directory):
         return None
 
 
-def load_base64_encoded_image(file_path):
-    """Loads an image file and returns its content as a base64-encoded string."""
+def load_base64_encoded_image(base_dir, filename):
+    """Loads an image file and returns its content as a base64-encoded string.
+    
+    Args:
+        base_dir: The base directory containing the file.
+        filename: The name of the file to load.
+    """
+    # Security: validate_directory_path and safe_path_join sanitize paths
+    try:
+        validated_dir = validate_directory_path(base_dir)  # lgtm[py/path-injection]
+        file_path = safe_path_join(validated_dir, filename)  # lgtm[py/path-injection]
+    except (ValueError, FileNotFoundError) as e:
+        logger.error(f"Invalid file path: {e}")
+        return ""
+        
     if os.path.exists(file_path):
         try:
             with open(file_path, "rb") as file:
@@ -485,8 +528,21 @@ def load_base64_encoded_image(file_path):
     return ""
 
 
-def load_base64_encoded_text(file_path):
-    """Loads a text file (e.g., README.md) and returns its content as a base64-encoded string."""
+def load_base64_encoded_text(base_dir, filename):
+    """Loads a text file (e.g., README.md) and returns its content as a base64-encoded string.
+    
+    Args:
+        base_dir: The base directory containing the file.
+        filename: The name of the file to load.
+    """
+    # Security: validate_directory_path and safe_path_join sanitize paths
+    try:
+        validated_dir = validate_directory_path(base_dir)  # lgtm[py/path-injection]
+        file_path = safe_path_join(validated_dir, filename)  # lgtm[py/path-injection]
+    except (ValueError, FileNotFoundError) as e:
+        logger.error(f"Invalid file path: {e}")
+        return ""
+        
     if os.path.exists(file_path):
         try:
             with open(file_path, "rb") as file:
@@ -497,8 +553,21 @@ def load_base64_encoded_text(file_path):
     return ""
 
 
-def load_json_config(file_path):
-    """Loads a JSON configuration file from the specified path."""
+def load_json_config(base_dir, filename):
+    """Loads a JSON configuration file from the specified path.
+    
+    Args:
+        base_dir: The base directory containing the file.
+        filename: The name of the file to load.
+    """
+    # Security: validate_directory_path and safe_path_join sanitize paths
+    try:
+        validated_dir = validate_directory_path(base_dir)  # lgtm[py/path-injection]
+        file_path = safe_path_join(validated_dir, filename)  # lgtm[py/path-injection]
+    except (ValueError, FileNotFoundError) as e:
+        logger.error(f"Invalid file path: {e}")
+        return {}
+        
     if os.path.exists(file_path):
         try:
             with open(file_path, "r", encoding="utf-8") as file:
@@ -589,11 +658,11 @@ def publish_new_pack_version(api_url, pack_id, pack_version, registry_id, pack_n
     # Best-effort: also update metadata (avatar, description, url, visibility, config, readme)
     # and compatibility if provided in properties.yaml so the new version push also refreshes pack details.
     try:
-        pack_dir = source_dir or f"./{pack_name}_pack"
+        pack_dir = os.path.abspath(source_dir or f"./{pack_name}_pack")
         props = load_pack_properties(pack_dir) or {}
-        pack_icon = load_base64_encoded_image(os.path.join(pack_dir, "icon.png"))
-        readme = load_base64_encoded_text(os.path.join(pack_dir, "README.md"))
-        pack_config = load_json_config(os.path.join(pack_dir, "pack_conf.json"))
+        pack_icon = load_base64_encoded_image(pack_dir, "icon.png")
+        readme = load_base64_encoded_text(pack_dir, "README.md")
+        pack_config = load_json_config(pack_dir, "pack_conf.json")
         pack_type = props.get("type", "")
         pack_description = props.get("description", "")
         pack_url = props.get("url", "")
@@ -662,7 +731,7 @@ def create_new_pack(
     }
     # Optionally add compatible_sources from properties.yaml if provided
     try:
-        pack_dir = source_dir or f"./{pack_name}_pack"
+        pack_dir = os.path.abspath(source_dir or f"./{pack_name}_pack")
         props = load_pack_properties(pack_dir) or {}
         compat = props.get("compatible_sources")
         if isinstance(compat, builtins.list) and all(isinstance(x, str) for x in compat):
@@ -720,9 +789,9 @@ def _push_with_context(agent_conf, pack_properties, pack_directory, config):
     pack_visibility = pack_properties.get("visibility", "private")
 
     # Handle pack icon and README/config
-    pack_icon = load_base64_encoded_image(os.path.join(pack_directory, "icon.png"))
-    readme = load_base64_encoded_text(os.path.join(pack_directory, "README.md"))
-    pack_config = load_json_config(os.path.join(pack_directory, "pack_conf.json"))
+    pack_icon = load_base64_encoded_image(pack_directory, "icon.png")
+    readme = load_base64_encoded_text(pack_directory, "README.md")
+    pack_config = load_json_config(pack_directory, "pack_conf.json")
 
     # Check existing packs and versions
     pack_id, existing_versions = find_existing_pack(
@@ -846,9 +915,12 @@ def push_from_directory(config, pack_directory):
             logger.error(msg)
             return False, msg
 
-        pack_directory = os.path.abspath(pack_directory)
-        if not os.path.isdir(pack_directory):
-            msg = f"Pack directory '{pack_directory}' does not exist."
+        # Validate and normalize the path using secure validation
+        # Security: validate_directory_path sanitizes the path before use
+        try:
+            pack_directory = validate_directory_path(pack_directory)  # lgtm[py/path-injection]
+        except (ValueError, FileNotFoundError) as e:
+            msg = f"Pack directory validation failed: {e}"
             logger.error(msg)
             return False, msg
 

qalita/commands/source.py

@@ -7,7 +7,7 @@ import click
 from tabulate import tabulate
 
 from qalita.__main__ import pass_config
-from qalita.internal.utils import logger, ask_confirmation, test_connection
+from qalita.internal.utils import logger, ask_confirmation, test_connection, safe_path_check, validate_file_path
 from qalita.internal.request import send_api_request
 
 
@@ -164,11 +164,16 @@ def validate_source(config):
                     is_source_valid = False
                 else:
                     # check for read access to path
-                    path = source["config"]["path"]
-                    if not os.access(path, os.R_OK):
-                        logger.error(
-                            f"Source [{source['name']}] has a path in config, but it cannot be accessed"
-                        )
+                    try:
+                        # Security: validate_file_path sanitizes the path before use
+                        validated_path = validate_file_path(source["config"]["path"])  # lgtm[py/path-injection]
+                        if not os.access(validated_path, os.R_OK):
+                            logger.error(
+                                f"Source [{source['name']}] has a path in config, but it cannot be accessed"
+                            )
+                            is_source_valid = False
+                    except (ValueError, FileNotFoundError) as e:
+                        logger.error(f"Source [{source['name']}] has an invalid path: {e}")
                         is_source_valid = False
 
         # If all checks pass, mark the source as valid

qalita/commands/worker.py

@@ -570,16 +570,40 @@ def pull_pack(config, pack_id, pack_version=None):
 
     jobs_path = config.get_worker_run_path()
     # Système de caching, on regarde si le pack est déjà présent dans le cache sinon on le télécharge
-    file_name = pack_url.split("/")[-1]
-    bucket_name = pack_url.split("/")[3]
-    s3_folder = "/".join(pack_url.split("/")[4:-1])
-    local_path = f"{jobs_path}/{bucket_name}/{s3_folder}/{file_name}"
+    # Validate URL components to prevent path traversal attacks
+    import re
+    url_parts = pack_url.split("/")
+    file_name = url_parts[-1] if url_parts else ""
+    bucket_name = url_parts[3] if len(url_parts) > 3 else ""
+    s3_folder = "/".join(url_parts[4:-1]) if len(url_parts) > 4 else ""
+    
+    # Sanitize path components - only allow alphanumeric, dots, hyphens, underscores
+    safe_pattern = re.compile(r'^[\w\-\.]+$')
+    if not file_name or not safe_pattern.match(file_name):
+        logger.error(f"Invalid file name in pack URL: {file_name}")
+        sys.exit(1)
+    if bucket_name and not safe_pattern.match(bucket_name):
+        logger.error(f"Invalid bucket name in pack URL: {bucket_name}")
+        sys.exit(1)
+    
+    # Build path and validate it stays within jobs_path
+    cache_folder = os.path.join(jobs_path, bucket_name, s3_folder) if s3_folder else os.path.join(jobs_path, bucket_name)
+    local_path = os.path.join(cache_folder, file_name)
+    
+    # Resolve to real paths and verify containment
+    jobs_path_real = os.path.realpath(os.path.abspath(jobs_path))
+    local_path_normalized = os.path.normpath(os.path.abspath(local_path))
+    
+    # Check that the path doesn't escape jobs_path
+    if not local_path_normalized.startswith(jobs_path_real + os.sep) and local_path_normalized != jobs_path_real:
+        logger.error(f"Invalid pack cache path detected: {local_path_normalized}")
+        sys.exit(1)
 
     if os.path.exists(local_path):
         logger.info(f"Using CACHED Pack at : {local_path}")
         return local_path, pack_version
-    if not os.path.exists(f"{jobs_path}/{bucket_name}/{s3_folder}"):
-        os.makedirs(f"{jobs_path}/{bucket_name}/{s3_folder}")
+    if not os.path.exists(cache_folder):
+        os.makedirs(cache_folder)
 
     # Fetch the pack from api
     response = send_api_request(f"/api/v1/assets/{pack_asset_id}/fetch", "get")
@@ -678,27 +702,51 @@ def job_run(
     # Uncompress the pack
     archive_name = pack_file_path.split("/")[-1]
     archive_path = os.path.join(temp_folder_name, archive_name)
-    with tarfile.open(archive_path, "r:gz") as tar:
-        # Validate members
-        safe_members = []
+    
+    def is_within_directory(directory: str, target: str) -> bool:
+        """Check if target path is within the directory (prevents path traversal)."""
+        abs_directory = os.path.abspath(directory)
+        abs_target = os.path.abspath(target)
+        prefix = os.path.commonprefix([abs_directory, abs_target])
+        return prefix == abs_directory
+    
+    def safe_extract(tar: tarfile.TarFile, path: str) -> None:
+        """Safely extract tar members, preventing path traversal attacks."""
         for member in tar.getmembers():
-            # Skip if not a file
-            if not member.isfile():
+            member_path = os.path.join(path, member.name)
+            
+            # Check for absolute paths
+            if os.path.isabs(member.name):
+                logger.warning(f"Skipping absolute path in tar: {member.name}")
                 continue
-            # Check for path traversal attack
-            if member.name.startswith(("/", "..")):
-                logger.warning(
-                    f"Skipping potentially dangerous tar file member {member.name}"
-                )
+            
+            # Check for path traversal using '..'
+            if ".." in member.name.split("/") or ".." in member.name.split(os.sep):
+                logger.warning(f"Skipping path traversal attempt in tar: {member.name}")
                 continue
-            safe_members.append(member)
-        # Assert that all members are safe
-        if not all(
-            not member.name.startswith(("/", "..")) for member in safe_members
-        ):
-            raise AssertionError("Unsafe tar file member detected")
-        # Extract safe members
-        tar.extractall(path=temp_folder_name, members=safe_members)
+            
+            # Verify the resolved path is within the extraction directory
+            if not is_within_directory(path, member_path):
+                logger.warning(f"Skipping path outside extraction directory: {member.name}")
+                continue
+            
+            # Check for unsafe symlinks
+            if member.issym() or member.islnk():
+                # Resolve the link target
+                if member.issym():
+                    link_target = os.path.join(os.path.dirname(member_path), member.linkname)
+                else:
+                    link_target = os.path.join(path, member.linkname)
+                
+                if not is_within_directory(path, link_target):
+                    logger.warning(f"Skipping symlink pointing outside directory: {member.name} -> {member.linkname}")
+                    continue
+            
+            # Extract the safe member
+            tar.extract(member, path)
+    
+    with tarfile.open(archive_path, "r:gz") as tar:
+        safe_extract(tar, temp_folder_name)
 
     # Delete the compressed pack (Windows may keep a short lock; retry briefly)
     for _ in range(5):

qalita/internal/request.py

@@ -121,7 +121,10 @@ def send_request(
             token = None
     headers = {"Authorization": f"Bearer {token}"} if token else {}
 
-    verify_ssl = not os.getenv("SKIP_SSL_VERIFY", False)
+    # SSL verification is enabled by default for security
+    # Only disable if SKIP_SSL_VERIFY is explicitly set to a truthy value
+    skip_ssl_env = os.getenv("SKIP_SSL_VERIFY", "").lower()
+    verify_ssl = skip_ssl_env not in ("true", "1", "yes", "on")
 
     try:
         if mode == "post":