tree-sitter-analyzer 0.8.3__py3-none-any.whl → 0.9.2__py3-none-any.whl

tree_sitter_analyzer/security/validator.py

@@ -8,8 +8,6 @@ ValidationHelper but enhanced for tree-sitter analyzer's requirements.
 
 import os
 import re
-from pathlib import Path
-from typing import Optional, Tuple
 
 from ..exceptions import SecurityError
 from ..utils import log_debug, log_warning
@@ -20,10 +18,10 @@ from .regex_checker import RegexSafetyChecker
 class SecurityValidator:
     """
     Unified security validation framework.
-    
+
     This class provides comprehensive security validation for file paths,
     regex patterns, and other user inputs to prevent security vulnerabilities.
-    
+
     Features:
     - Multi-layer path traversal protection
     - Project boundary enforcement
@@ -31,10 +29,10 @@ class SecurityValidator:
     - Input sanitization
     """
 
-    def __init__(self, project_root: Optional[str] = None) -> None:
+    def __init__(self, project_root: str | None = None) -> None:
         """
         Initialize security validator.
-        
+
         Args:
             project_root: Optional project root directory for boundary checks
         """
@@ -42,25 +40,25 @@ class SecurityValidator:
             ProjectBoundaryManager(project_root) if project_root else None
         )
         self.regex_checker = RegexSafetyChecker()
-        
+
         log_debug(f"SecurityValidator initialized with project_root: {project_root}")
 
     def validate_file_path(
-        self, file_path: str, base_path: Optional[str] = None
-    ) -> Tuple[bool, str]:
+        self, file_path: str, base_path: str | None = None
+    ) -> tuple[bool, str]:
         """
         Validate file path with comprehensive security checks.
-        
+
         Implements multi-layer defense against path traversal attacks
         and ensures file access stays within project boundaries.
-        
+
         Args:
             file_path: File path to validate
             base_path: Optional base path for relative path validation
-            
+
         Returns:
             Tuple of (is_valid, error_message)
-            
+
         Example:
             >>> validator = SecurityValidator("/project/root")
             >>> is_valid, error = validator.validate_file_path("src/main.py")
@@ -70,71 +68,75 @@ class SecurityValidator:
             # Layer 1: Basic input validation
             if not file_path or not isinstance(file_path, str):
                 return False, "File path must be a non-empty string"
-            
+
             # Layer 2: Null byte injection check
             if "\x00" in file_path:
                 log_warning(f"Null byte detected in file path: {file_path}")
                 return False, "File path contains null bytes"
-            
+
             # Layer 3: Windows drive letter check (only on non-Windows systems)
-            if len(file_path) > 1 and file_path[1] == ":" and os.name != 'nt':
+            if len(file_path) > 1 and file_path[1] == ":" and os.name != "nt":
                 return False, "Windows drive letters are not allowed on this system"
 
-            # Layer 4: Absolute path check (handle Windows leading slash/backslash explicitly)
-            is_abs = os.path.isabs(file_path) or (
-                os.name == 'nt' and (file_path.startswith('/') or file_path.startswith('\\'))
-            )
-            if is_abs:
-                # If we have a project root, check if the absolute path is within it
+            # Layer 4: Absolute path check (cross-platform)
+            if os.path.isabs(file_path) or file_path.startswith(("/", "\\")):
+                # If project boundaries are configured, enforce them strictly
                 if self.boundary_manager and self.boundary_manager.project_root:
                     if not self.boundary_manager.is_within_project(file_path):
                         return False, "Absolute path must be within project directory"
+                    # Within project
+                    return True, ""
                 else:
-                    # In test environments (temp directories), allow absolute paths
+                    # In test/dev contexts without project boundaries, allow absolute
+                    # paths under system temp folder only (safe sandbox)
                     import tempfile
-                    temp_dir = tempfile.gettempdir()
-                    if file_path.startswith(temp_dir):
+
+                    temp_dir = os.path.realpath(tempfile.gettempdir())
+                    real_path = os.path.realpath(file_path)
+                    if real_path.startswith(temp_dir + os.sep) or real_path == temp_dir:
                         return True, ""
-                    # No project root defined, reject all other absolute paths
                     return False, "Absolute file paths are not allowed"
-            
+
             # Layer 5: Path normalization and traversal check
             norm_path = os.path.normpath(file_path)
             if "..\\" in norm_path or "../" in norm_path or norm_path.startswith(".."):
                 log_warning(f"Path traversal attempt detected: {file_path}")
                 return False, "Directory traversal not allowed"
-            
+
             # Layer 6: Project boundary validation
             if self.boundary_manager and base_path:
                 if not self.boundary_manager.is_within_project(
                     os.path.join(base_path, norm_path)
                 ):
-                    return False, "Access denied. File path must be within project directory"
-            
+                    return (
+                        False,
+                        "Access denied. File path must be within project directory",
+                    )
+
             # Layer 7: Symbolic link check (if file exists)
             if base_path:
                 full_path = os.path.join(base_path, norm_path)
                 if os.path.exists(full_path) and os.path.islink(full_path):
                     log_warning(f"Symbolic link detected: {full_path}")
                     return False, "Symbolic links are not allowed"
-            
+
             log_debug(f"File path validation passed: {file_path}")
             return True, ""
-            
+
         except Exception as e:
             log_warning(f"File path validation error: {e}")
             return False, f"Validation error: {str(e)}"
 
     def validate_directory_path(
         self, dir_path: str, must_exist: bool = True
-    ) -> Tuple[bool, str]:
+    ) -> tuple[bool, str]:
         """
         Validate directory path for security and existence.
-        
+
         Args:
             dir_path: Directory path to validate
             must_exist: Whether directory must exist
-            
+
         Returns:
             Tuple of (is_valid, error_message)
         """
@@ -143,29 +145,29 @@ class SecurityValidator:
             is_valid, error = self.validate_file_path(dir_path)
             if not is_valid:
                 return False, error
-            
+
             # Check if path exists and is directory
             if must_exist:
                 if not os.path.exists(dir_path):
                     return False, f"Directory does not exist: {dir_path}"
-                
+
                 if not os.path.isdir(dir_path):
                     return False, f"Path is not a directory: {dir_path}"
-            
+
             log_debug(f"Directory path validation passed: {dir_path}")
             return True, ""
-            
+
         except Exception as e:
             log_warning(f"Directory path validation error: {e}")
             return False, f"Validation error: {str(e)}"
 
-    def validate_regex_pattern(self, pattern: str) -> Tuple[bool, str]:
+    def validate_regex_pattern(self, pattern: str) -> tuple[bool, str]:
         """
         Validate regex pattern for ReDoS attack prevention.
-        
+
         Args:
             pattern: Regex pattern to validate
-            
+
         Returns:
             Tuple of (is_valid, error_message)
         """
@@ -174,31 +176,31 @@ class SecurityValidator:
     def sanitize_input(self, user_input: str, max_length: int = 1000) -> str:
         """
         Sanitize user input by removing dangerous characters.
-        
+
         Args:
             user_input: Input string to sanitize
             max_length: Maximum allowed length
-            
+
         Returns:
             Sanitized input string
-            
+
         Raises:
             SecurityError: If input is too long or contains dangerous content
         """
         if not isinstance(user_input, str):
             raise SecurityError("Input must be a string")
-        
+
         if len(user_input) > max_length:
             raise SecurityError(f"Input too long: {len(user_input)} > {max_length}")
-        
+
         # Remove null bytes and control characters
-        sanitized = re.sub(r'[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]', '', user_input)
+        sanitized = re.sub(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]", "", user_input)
 
         # Remove HTML/XML tags for XSS prevention
-        sanitized = re.sub(r'<[^>]*>', '', sanitized)
+        sanitized = re.sub(r"<[^>]*>", "", sanitized)
 
         # Remove potentially dangerous characters
-        sanitized = re.sub(r'[<>"\']', '', sanitized)
+        sanitized = re.sub(r'[<>"\']', "", sanitized)
 
         # Log if sanitization occurred
         if sanitized != user_input:
@@ -206,13 +208,13 @@ class SecurityValidator:
 
         return sanitized
 
-    def validate_glob_pattern(self, pattern: str) -> Tuple[bool, str]:
+    def validate_glob_pattern(self, pattern: str) -> tuple[bool, str]:
         """
         Validate glob pattern for safe file matching.
-        
+
         Args:
             pattern: Glob pattern to validate
-            
+
         Returns:
             Tuple of (is_valid, error_message)
         """
@@ -220,25 +222,25 @@ class SecurityValidator:
             # Basic input validation
             if not pattern or not isinstance(pattern, str):
                 return False, "Pattern must be a non-empty string"
-            
+
             # Check for dangerous patterns
             dangerous_patterns = [
                 "..",  # Path traversal
                 "//",  # Double slashes
                 "\\\\",  # Double backslashes
             ]
-            
+
             for dangerous in dangerous_patterns:
                 if dangerous in pattern:
                     return False, f"Dangerous pattern detected: {dangerous}"
-            
+
             # Validate length
             if len(pattern) > 500:
                 return False, "Pattern too long"
-            
+
             log_debug(f"Glob pattern validation passed: {pattern}")
             return True, ""
-            
+
         except Exception as e:
             log_warning(f"Glob pattern validation error: {e}")
             return False, f"Validation error: {str(e)}"