rasa-pro 3.12.31__py3-none-any.whl → 3.12.32__py3-none-any.whl

rasa/engine/storage/local_model_storage.py

@@ -10,7 +10,7 @@ import uuid
 from contextlib import contextmanager
 from datetime import datetime
 from pathlib import Path
-from typing import Callable, Generator, Optional, Text, Tuple, Union
+from typing import Callable, Generator, List, Optional, Text, Tuple, Union
 
 from tarsafe import TarSafe
 
@@ -158,16 +158,24 @@ class LocalModelStorage(ModelStorage):
                     # before trying the \\?\ prefix approach first
                     prev_filter = getattr(tar, "extraction_filter", None)
                     tar.extraction_filter = create_combined_filter(prev_filter)
-                    tar.extractall(f"\\\\?\\{temporary_directory}")
+                    tar.extractall(
+                        f"\\\\?\\{temporary_directory}",
+                        members=yield_safe_members(tar.getmembers()),
+                    )
                 except Exception:
                     # Fallback for Python versions with tarfile security fix
                     logger.warning(
                         "Failed to extract model archive with long path support. "
                         "Falling back to regular extraction."
                     )
-                    tar.extractall(temporary_directory)
+                    tar.extractall(
+                        temporary_directory,
+                        members=yield_safe_members(tar.getmembers()),
+                    )
             else:
-                tar.extractall(temporary_directory)
+                tar.extractall(
+                    temporary_directory, members=yield_safe_members(tar.getmembers())
+                )
         LocalModelStorage._assert_not_rasa2_archive(temporary_directory)
 
     @staticmethod
@@ -287,3 +295,32 @@ class LocalModelStorage(ModelStorage):
             core_target=model_configuration.core_target,
             nlu_target=model_configuration.nlu_target,
         )
+
+
+def yield_safe_members(
+    members: List[tarfile.TarInfo],
+) -> Generator[tarfile.TarInfo, None, None]:
+    """
+    Filter function for tar.extractall members parameter.
+    Validates each member and yields only safe ones.
+
+    Args:
+        members: Iterator of TarInfo objects from tar.getmembers()
+
+    Yields:
+        TarInfo: Safe members to extract
+    """
+    for member in members:
+        # Skip absolute paths
+        if Path(member.name).is_absolute():
+            continue
+
+        # Skip paths with directory traversal sequences
+        if ".." in member.name or "\\.." in member.name:
+            continue
+
+        # Skip special file types unless you need them
+        if member.isdev() or member.issym():
+            continue
+
+        yield member

rasa/version.py

@@ -1,3 +1,3 @@
 # this file will automatically be changed,
 # do not add anything but the version number here!
-__version__ = "3.12.31"
+__version__ = "3.12.32"

{rasa_pro-3.12.31.dist-info → rasa_pro-3.12.32.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: rasa-pro
-Version: 3.12.31
+Version: 3.12.32
 Summary: State-of-the-art open-core Conversational AI framework for Enterprises that natively leverages generative AI for effortless assistant development.
 Keywords: nlp,machine-learning,machine-learning-library,bot,bots,botkit,rasa conversational-agents,conversational-ai,chatbot,chatbot-framework,bot-framework
 Author: Rasa Technologies GmbH
@@ -103,7 +103,7 @@ Requires-Dist: randomname (>=0.2.1,<0.3.0)
 Requires-Dist: rasa-sdk (==3.12.0)
 Requires-Dist: redis (>=4.6.0,<6.0)
 Requires-Dist: regex (>=2024.7.24,<2024.8.0)
-Requires-Dist: requests (>=2.32.3,<2.33.0)
+Requires-Dist: requests (>=2.32.5,<2.33.0)
 Requires-Dist: rich (>=13.4.2,<14.0.0)
 Requires-Dist: rocketchat_API (>=1.32.0,<1.33.0)
 Requires-Dist: ruamel.yaml (>=0.17.21,<0.17.22)
@@ -118,7 +118,7 @@ Requires-Dist: sentencepiece[sentencepiece] (>=0.1.99,<0.2.0) ; extra == "transf
 Requires-Dist: sentry-sdk (>=2.8.0,<3)
 Requires-Dist: setuptools (>=78.1.1,<78.2.0)
 Requires-Dist: sklearn-crfsuite (>=0.3.6,<0.4.0)
-Requires-Dist: skops (>=0.10.0,<0.11.0)
+Requires-Dist: skops (>=0.13.0,<0.14.0)
 Requires-Dist: slack-sdk (>=3.27.1,<3.28.0)
 Requires-Dist: spacy (>=3.5.4,<4.0.0) ; extra == "spacy" or extra == "full"
 Requires-Dist: structlog (>=23.1.0,<23.2.0)

{rasa_pro-3.12.31.dist-info → rasa_pro-3.12.32.dist-info}/RECORD

@@ -503,7 +503,7 @@ rasa/engine/runner/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuF
 rasa/engine/runner/dask.py,sha256=ocmpRpDpRPMaisZcBFDeUPbWGl6oWiU9UXyWimE9074,9476
 rasa/engine/runner/interface.py,sha256=zkaKe5vjiYrR7Efepr7LVZRJEGNDM959rkdR62vEgTM,1679
 rasa/engine/storage/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-rasa/engine/storage/local_model_storage.py,sha256=Y2VKg04I63WgIL9XeLhJs7SkQMRqUziKyTj9QnhTWZ8,11382
+rasa/engine/storage/local_model_storage.py,sha256=kVkINXxwJVcRQmOCyD8K7N01ATZtOqKrFpA7kb6z7oI,12473
 rasa/engine/storage/resource.py,sha256=sUCBNSIrjEr68wCj7D48hzmIih7ezmT88esMhyykA88,3932
 rasa/engine/storage/storage.py,sha256=mNLptsu9cOXWu8k55CnjZMByv6eqh2rEOqXC9__k8aE,6930
 rasa/engine/training/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -822,9 +822,9 @@ rasa/utils/train_utils.py,sha256=ClJx-6x3-h3Vt6mskacgkcCUJTMXjFPe3zAcy_DfmaU,212
 rasa/utils/url_tools.py,sha256=dZ1HGkVdWTJB7zYEdwoDIrEuyX9HE5WsxKKFVsXBLE0,1218
 rasa/utils/yaml.py,sha256=KjbZq5C94ZP7Jdsw8bYYF7HASI6K4-C_kdHfrnPLpSI,2000
 rasa/validator.py,sha256=524VlFTYK0B3iXYveVD6BDC3K0j1QfpzJ9O-TAWczmc,83166
-rasa/version.py,sha256=2Z_MhUOhckb-Tlm2UuPGZdu3Albffu_Js1q85XaCmXo,118
-rasa_pro-3.12.31.dist-info/METADATA,sha256=0IoqbSS8YRmiKFl7qocrUXcFHfoa0NBRd5yfArRgzmc,10609
-rasa_pro-3.12.31.dist-info/NOTICE,sha256=7HlBoMHJY9CL2GlYSfTQ-PZsVmLmVkYmMiPlTjhuCqA,218
-rasa_pro-3.12.31.dist-info/WHEEL,sha256=fGIA9gx4Qxk2KDKeNJCbOEwSrmLtjWCwzBz351GyrPQ,88
-rasa_pro-3.12.31.dist-info/entry_points.txt,sha256=ckJ2SfEyTPgBqj_I6vm_tqY9dZF_LAPJZA335Xp0Q9U,43
-rasa_pro-3.12.31.dist-info/RECORD,,
+rasa/version.py,sha256=0jQ2Z9MlEZq5LE0RbR_32-V_zhhpiBjIXu7kqb57q5o,118
+rasa_pro-3.12.32.dist-info/METADATA,sha256=I4-ePtMb2yxAT-TkIqxVoCL2NUPCsSVo-f4sflNjIzo,10609
+rasa_pro-3.12.32.dist-info/NOTICE,sha256=7HlBoMHJY9CL2GlYSfTQ-PZsVmLmVkYmMiPlTjhuCqA,218
+rasa_pro-3.12.32.dist-info/WHEEL,sha256=fGIA9gx4Qxk2KDKeNJCbOEwSrmLtjWCwzBz351GyrPQ,88
+rasa_pro-3.12.32.dist-info/entry_points.txt,sha256=ckJ2SfEyTPgBqj_I6vm_tqY9dZF_LAPJZA335Xp0Q9U,43
+rasa_pro-3.12.32.dist-info/RECORD,,