rasa-pro 3.12.30__py3-none-any.whl → 3.12.32__py3-none-any.whl

rasa/engine/storage/local_model_storage.py

@@ -1,14 +1,16 @@
 from __future__ import annotations
 
 import logging
+import os
 import shutil
 import sys
+import tarfile
 import tempfile
 import uuid
 from contextlib import contextmanager
 from datetime import datetime
 from pathlib import Path
-from typing import Generator, Optional, Text, Tuple, Union
+from typing import Callable, Generator, List, Optional, Text, Tuple, Union
 
 from tarsafe import TarSafe
 
@@ -57,6 +59,35 @@ def windows_safe_temporary_directory(
             yield temporary_directory
 
 
+def filter_normpath(member: tarfile.TarInfo, dest_path: str) -> tarfile.TarInfo:
+    """Normalize tar member paths for safe extraction"""
+    if member.name:
+        member.name = os.path.normpath(member.name)
+    return member
+
+
+FilterFunction = Callable[[tarfile.TarInfo, str], Optional[tarfile.TarInfo]]
+
+
+def create_combined_filter(existing_filter: Optional[FilterFunction]) -> FilterFunction:
+    """Create a filter that combines existing filter with path normalization"""
+
+    def combined_filter(
+        member: tarfile.TarInfo, dest_path: str
+    ) -> Optional[tarfile.TarInfo]:
+        """Apply existing filter first, then path normalization"""
+        if existing_filter is not None:
+            filtered_member = existing_filter(member, dest_path)
+            if filtered_member is None:
+                return None  # Rejected by existing filter
+            member = filtered_member  # Use the filtered result
+
+        # Apply our path normalization
+        return filter_normpath(member, dest_path)
+
+    return combined_filter
+
+
 class LocalModelStorage(ModelStorage):
     """Stores and provides output of `GraphComponents` on local disk."""
 
@@ -122,9 +153,29 @@ class LocalModelStorage(ModelStorage):
                 # this restriction in environments where it's not possible
                 # to override this behavior, mostly for internal policy reasons
                 # reference: https://stackoverflow.com/a/49102229
-                tar.extractall(f"\\\\?\\{temporary_directory}")
+                try:
+                    # Use extraction filter to normalize paths for compatibility
+                    # before trying the \\?\ prefix approach first
+                    prev_filter = getattr(tar, "extraction_filter", None)
+                    tar.extraction_filter = create_combined_filter(prev_filter)
+                    tar.extractall(
+                        f"\\\\?\\{temporary_directory}",
+                        members=yield_safe_members(tar.getmembers()),
+                    )
+                except Exception:
+                    # Fallback for Python versions with tarfile security fix
+                    logger.warning(
+                        "Failed to extract model archive with long path support. "
+                        "Falling back to regular extraction."
+                    )
+                    tar.extractall(
+                        temporary_directory,
+                        members=yield_safe_members(tar.getmembers()),
+                    )
             else:
-                tar.extractall(temporary_directory)
+                tar.extractall(
+                    temporary_directory, members=yield_safe_members(tar.getmembers())
+                )
         LocalModelStorage._assert_not_rasa2_archive(temporary_directory)
 
     @staticmethod
@@ -244,3 +295,32 @@ class LocalModelStorage(ModelStorage):
             core_target=model_configuration.core_target,
             nlu_target=model_configuration.nlu_target,
         )
+
+
+def yield_safe_members(
+    members: List[tarfile.TarInfo],
+) -> Generator[tarfile.TarInfo, None, None]:
+    """
+    Filter function for tar.extractall members parameter.
+    Validates each member and yields only safe ones.
+
+    Args:
+        members: Iterator of TarInfo objects from tar.getmembers()
+
+    Yields:
+        TarInfo: Safe members to extract
+    """
+    for member in members:
+        # Skip absolute paths
+        if Path(member.name).is_absolute():
+            continue
+
+        # Skip paths with directory traversal sequences
+        if ".." in member.name or "\\.." in member.name:
+            continue
+
+        # Skip special file types unless you need them
+        if member.isdev() or member.issym():
+            continue
+
+        yield member

rasa/version.py

@@ -1,3 +1,3 @@
 # this file will automatically be changed,
 # do not add anything but the version number here!
-__version__ = "3.12.30"
+__version__ = "3.12.32"

{rasa_pro-3.12.30.dist-info → rasa_pro-3.12.32.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: rasa-pro
-Version: 3.12.30
+Version: 3.12.32
 Summary: State-of-the-art open-core Conversational AI framework for Enterprises that natively leverages generative AI for effortless assistant development.
 Keywords: nlp,machine-learning,machine-learning-library,bot,bots,botkit,rasa conversational-agents,conversational-ai,chatbot,chatbot-framework,bot-framework
 Author: Rasa Technologies GmbH
@@ -103,7 +103,7 @@ Requires-Dist: randomname (>=0.2.1,<0.3.0)
 Requires-Dist: rasa-sdk (==3.12.0)
 Requires-Dist: redis (>=4.6.0,<6.0)
 Requires-Dist: regex (>=2024.7.24,<2024.8.0)
-Requires-Dist: requests (>=2.32.3,<2.33.0)
+Requires-Dist: requests (>=2.32.5,<2.33.0)
 Requires-Dist: rich (>=13.4.2,<14.0.0)
 Requires-Dist: rocketchat_API (>=1.32.0,<1.33.0)
 Requires-Dist: ruamel.yaml (>=0.17.21,<0.17.22)
@@ -118,7 +118,7 @@ Requires-Dist: sentencepiece[sentencepiece] (>=0.1.99,<0.2.0) ; extra == "transf
 Requires-Dist: sentry-sdk (>=2.8.0,<3)
 Requires-Dist: setuptools (>=78.1.1,<78.2.0)
 Requires-Dist: sklearn-crfsuite (>=0.3.6,<0.4.0)
-Requires-Dist: skops (>=0.10.0,<0.11.0)
+Requires-Dist: skops (>=0.13.0,<0.14.0)
 Requires-Dist: slack-sdk (>=3.27.1,<3.28.0)
 Requires-Dist: spacy (>=3.5.4,<4.0.0) ; extra == "spacy" or extra == "full"
 Requires-Dist: structlog (>=23.1.0,<23.2.0)

{rasa_pro-3.12.30.dist-info → rasa_pro-3.12.32.dist-info}/RECORD

@@ -503,7 +503,7 @@ rasa/engine/runner/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuF
 rasa/engine/runner/dask.py,sha256=ocmpRpDpRPMaisZcBFDeUPbWGl6oWiU9UXyWimE9074,9476
 rasa/engine/runner/interface.py,sha256=zkaKe5vjiYrR7Efepr7LVZRJEGNDM959rkdR62vEgTM,1679
 rasa/engine/storage/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-rasa/engine/storage/local_model_storage.py,sha256=szLUl7h8815G8PWi_eecjJwdEOsvTIB8_2dFzuCHP44,9607
+rasa/engine/storage/local_model_storage.py,sha256=kVkINXxwJVcRQmOCyD8K7N01ATZtOqKrFpA7kb6z7oI,12473
 rasa/engine/storage/resource.py,sha256=sUCBNSIrjEr68wCj7D48hzmIih7ezmT88esMhyykA88,3932
 rasa/engine/storage/storage.py,sha256=mNLptsu9cOXWu8k55CnjZMByv6eqh2rEOqXC9__k8aE,6930
 rasa/engine/training/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -822,9 +822,9 @@ rasa/utils/train_utils.py,sha256=ClJx-6x3-h3Vt6mskacgkcCUJTMXjFPe3zAcy_DfmaU,212
 rasa/utils/url_tools.py,sha256=dZ1HGkVdWTJB7zYEdwoDIrEuyX9HE5WsxKKFVsXBLE0,1218
 rasa/utils/yaml.py,sha256=KjbZq5C94ZP7Jdsw8bYYF7HASI6K4-C_kdHfrnPLpSI,2000
 rasa/validator.py,sha256=524VlFTYK0B3iXYveVD6BDC3K0j1QfpzJ9O-TAWczmc,83166
-rasa/version.py,sha256=9pHHdCcacB7k3dA4b6QLVw9JG0FDRA0ckMI39G-23fI,118
-rasa_pro-3.12.30.dist-info/METADATA,sha256=G441WLaRBhJh8vVqd4RRdKP2PvQN5KruxfCbc7lh4QQ,10609
-rasa_pro-3.12.30.dist-info/NOTICE,sha256=7HlBoMHJY9CL2GlYSfTQ-PZsVmLmVkYmMiPlTjhuCqA,218
-rasa_pro-3.12.30.dist-info/WHEEL,sha256=fGIA9gx4Qxk2KDKeNJCbOEwSrmLtjWCwzBz351GyrPQ,88
-rasa_pro-3.12.30.dist-info/entry_points.txt,sha256=ckJ2SfEyTPgBqj_I6vm_tqY9dZF_LAPJZA335Xp0Q9U,43
-rasa_pro-3.12.30.dist-info/RECORD,,
+rasa/version.py,sha256=0jQ2Z9MlEZq5LE0RbR_32-V_zhhpiBjIXu7kqb57q5o,118
+rasa_pro-3.12.32.dist-info/METADATA,sha256=I4-ePtMb2yxAT-TkIqxVoCL2NUPCsSVo-f4sflNjIzo,10609
+rasa_pro-3.12.32.dist-info/NOTICE,sha256=7HlBoMHJY9CL2GlYSfTQ-PZsVmLmVkYmMiPlTjhuCqA,218
+rasa_pro-3.12.32.dist-info/WHEEL,sha256=fGIA9gx4Qxk2KDKeNJCbOEwSrmLtjWCwzBz351GyrPQ,88
+rasa_pro-3.12.32.dist-info/entry_points.txt,sha256=ckJ2SfEyTPgBqj_I6vm_tqY9dZF_LAPJZA335Xp0Q9U,43
+rasa_pro-3.12.32.dist-info/RECORD,,