verifiers 0.3.2.dev155__tar.gz → 0.3.2.dev157__tar.gz

{verifiers-0.3.2.dev155 → verifiers-0.3.2.dev157}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev155
+Version: 0.3.2.dev157
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers

{verifiers-0.3.2.dev155 → verifiers-0.3.2.dev157}/verifiers/v1/dialects/base.py

@@ -16,6 +16,7 @@ import logging
 from abc import ABC, abstractmethod
 from collections.abc import Callable, Mapping
 from glob import has_magic
+from ipaddress import ip_address
 from typing import Any, ClassVar, Generic, TypeVar
 
 from pydantic import AnyHttpUrl, BaseModel, ValidationError
@@ -129,10 +130,10 @@ class RequestFilter:
 def provider_domains(
     policy: NetworkPolicyConfig, requested: object = None
 ) -> list[str]:
-    """Translate allow/block rules to provider filters without changing their scope.
+    """Translate host rules to the provider's native domain filters.
 
-    Provider filters include subdomains, so exact hosts need a covering wildcard rule.
-    Empty results mean the policy cannot be represented; never send an empty filter.
+    Strip leading wildcards and let the provider define domain/subdomain scope.
+    Empty results mean unsupported rules; never send an empty filter.
     """
     rules = policy.block or policy.allow
     if requested is not None and not isinstance(requested, list):
@@ -149,9 +150,7 @@ def provider_domains(
                 url, host, port = parse_network_rule(rule)
             except ValueError:
                 return []
-            if is_filter and (
-                url.username is not None or url.path or url.query or url.fragment
-            ):
+            if url.username is not None or url.path or url.query or url.fragment:
                 return []
             domain = host if is_filter else host.removeprefix("*.")
             if (
@@ -162,17 +161,12 @@ def provider_domains(
                 or not domain.isascii()
             ):
                 return []
-            output.append(host)
-    for host in hosts:
-        if not host.startswith("*.") and not (
-            policy.block
-            and any(
-                wildcard.startswith("*.")
-                and intersect_network_hosts(wildcard, host) == host
-                for wildcard in hosts
-            )
-        ):
-            return []
+            try:
+                ip_address(domain)
+            except ValueError:
+                output.append(host)
+            else:
+                return []
     domains = list(dict.fromkeys(host.removeprefix("*.") for host in hosts))
     if requested is None:
         return domains

{verifiers-0.3.2.dev155 → verifiers-0.3.2.dev157}/verifiers/v1/utils/artifacts.py

@@ -141,7 +141,8 @@ async def restore(runtime: Runtime, collected: dict[str, bytes | None]) -> None:
 
     Archive bytes are untrusted: the agent controls both their source files and the
     runtime tooling that creates them. Every archive is therefore validated on the host
-    before the grading runtime is changed. Only regular files and directories travel.
+    before the grading runtime is changed. Regular files, directories, and confined links
+    can travel; link chains and extraction through symlinks cannot.
     """
     if not collected:
         return
@@ -214,6 +215,9 @@ def _validate_restore(root: str, archive: bytes | None) -> None:
 
     try:
         with tarfile.open(fileobj=io.BytesIO(archive), mode="r:") as tar:
+            regular_files: set[PurePosixPath] = set()
+            members: set[PurePosixPath] = set()
+            symlinks: dict[PurePosixPath, str] = {}
             for member in tar:
                 member_path = PurePosixPath(member.name)
                 destination = PurePosixPath("/") / member_path
@@ -227,10 +231,65 @@ def _validate_restore(root: str, archive: bytes | None) -> None:
                         f"artifact member {member.name!r} is outside declared root "
                         f"{root!r}"
                     )
-                if not (member.isfile() or member.isdir()):
+                if member_path in members:
+                    raise RuntimeError(f"duplicate artifact member {member.name!r}")
+                members.add(member_path)
+                if member.issym():
+                    symlinks[member_path] = member.linkname
+                elif member.islnk():
+                    # Tar deduplicates hard-linked build outputs (e.g. Cargo's build
+                    # scripts). A target must already be a regular member of this
+                    # archive, never a path supplied by the verifier image.
+                    target = PurePosixPath(member.linkname)
+                    if (
+                        not member.linkname
+                        or target.is_absolute()
+                        or ".." in target.parts
+                        or target not in regular_files
+                        or target == member_path
+                    ):
+                        raise RuntimeError(
+                            f"artifact hard link {member.name!r} has unsafe target "
+                            f"{member.linkname!r}"
+                        )
+                elif not (member.isfile() or member.isdir()):
                     raise RuntimeError(
                         f"artifact member {member.name!r} is a link or special file"
                     )
+                if member.isfile():
+                    regular_files.add(member_path)
+            # Check after reading the whole archive, so a later symlink cannot
+            # turn an earlier member's parent or a link target into a redirection.
+            for member_path in members:
+                if any(parent in symlinks for parent in member_path.parents):
+                    raise RuntimeError(
+                        f"artifact member {str(member_path)!r} traverses a symlink"
+                    )
+            relative_root = root_path.relative_to("/")
+            for member_path, linkname in symlinks.items():
+                target = PurePosixPath(linkname)
+                if not linkname or target.is_absolute():
+                    raise RuntimeError(
+                        f"artifact symlink {str(member_path)!r} has unsafe target "
+                        f"{linkname!r}"
+                    )
+                resolved = member_path.parent
+                if not resolved.is_relative_to(relative_root):
+                    raise RuntimeError(
+                        f"artifact symlink {str(member_path)!r} has unsafe target "
+                        f"{linkname!r}"
+                    )
+                # Walk before normalizing '..': a/../b is unsafe if a is itself
+                # a symlink. Missing internal targets are safe (e.g. build outputs).
+                for part in target.parts:
+                    resolved = resolved.parent if part == ".." else resolved / part
+                    if not resolved.is_relative_to(relative_root) or any(
+                        path in symlinks for path in (resolved, *resolved.parents)
+                    ):
+                        raise RuntimeError(
+                            f"artifact symlink {str(member_path)!r} has unsafe target "
+                            f"{linkname!r}"
+                        )
     except tarfile.TarError as exc:
         raise RuntimeError(f"unreadable artifact archive for {root!r}: {exc}") from exc