withruntime 0.7.1__tar.gz → 0.7.2__tar.gz

{withruntime-0.7.1/withruntime.egg-info → withruntime-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: withruntime
-Version: 0.7.1
+Version: 0.7.2
 Summary: Runtime Cloud: one client (sync and async) for every Runtime product. Sandboxes first.
 License: Apache-2.0
 Project-URL: Homepage, https://withruntime.com

{withruntime-0.7.1 → withruntime-0.7.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "withruntime"
-version = "0.7.1"
+version = "0.7.2"
 description = "Runtime Cloud: one client (sync and async) for every Runtime product. Sandboxes first."
 readme = "README.md"
 license = { text = "Apache-2.0" }

withruntime-0.7.2/tests/test_unpack.py

@@ -0,0 +1,79 @@
+"""A directory download cannot write outside its target (26 September 2026).
+
+The archive comes from the sandbox, so its contents are the customer's untrusted
+code's to choose. The old check looked at each name before extracting, while the
+archive's own links did not exist yet: a link ``x -> ../outside`` followed by
+``x/pwned.txt`` passed it and wrote outside. These archives are the ones a
+hostile sandbox would send."""
+import io
+import os
+import tarfile
+import tempfile
+import unittest
+
+from withruntime._errors import RuntimeError
+from withruntime._unpack import unpack_archive
+
+
+def archive(*entries):
+    buffer = io.BytesIO()
+    with tarfile.open(fileobj=buffer, mode="w:gz") as tar:
+        for name, kind, value in entries:
+            info = tarfile.TarInfo(name)
+            if kind == "dir":
+                info.type = tarfile.DIRTYPE
+                tar.addfile(info)
+            elif kind == "link":
+                info.type, info.linkname = tarfile.SYMTYPE, value
+                tar.addfile(info)
+            else:
+                body = value.encode()
+                info.size = len(body)
+                tar.addfile(info, io.BytesIO(body))
+    return buffer.getvalue()
+
+
+class Unpack(unittest.TestCase):
+    def setUp(self):
+        self.base = tempfile.TemporaryDirectory()
+        self.target = os.path.join(self.base.name, "target")
+        self.outside = os.path.join(self.base.name, "outside")
+        os.mkdir(self.outside)
+
+    def tearDown(self):
+        self.base.cleanup()
+
+    def refused(self, data, pattern):
+        with self.assertRaisesRegex(RuntimeError, pattern) as caught:
+            unpack_archive(data, self.target)
+        self.assertEqual(caught.exception.code, "unsafe_archive")
+
+    def test_a_link_then_a_file_through_it_cannot_write_outside(self):
+        self.refused(archive(("x", "link", "../outside"), ("x/pwned.txt", "file", "owned")), "outside the target")
+        self.assertFalse(os.path.exists(os.path.join(self.outside, "pwned.txt")))
+
+    def test_an_absolute_link_is_refused_and_removed(self):
+        self.refused(archive(("etc", "link", "/etc")), "leads outside the target")
+        self.assertFalse(os.path.lexists(os.path.join(self.target, "etc")))
+
+    def test_a_link_that_climbs_out_through_another_link_is_refused(self):
+        # Lexically d/up/.. is d; followed, d/up is the target and .. leaves it.
+        self.refused(archive(("d", "dir", None), ("d/up", "link", ".."), ("x", "link", "d/up/..")), "x -> d/up/..")
+        self.assertFalse(os.path.lexists(os.path.join(self.target, "x")))
+
+    def test_a_file_is_never_written_through_a_link_already_there(self):
+        os.mkdir(self.target)
+        os.symlink(self.outside, os.path.join(self.target, "cache"))
+        self.refused(archive(("cache/pwned.txt", "file", "owned")), "passes through a link")
+        self.assertFalse(os.path.exists(os.path.join(self.outside, "pwned.txt")))
+
+    def test_links_that_stay_inside_land_intact(self):
+        unpack_archive(archive(("./node_modules/pkg/cli.js", "file", "run()"),
+                               ("./node_modules/.bin/tool", "link", "../pkg/cli.js"),
+                               ("./current", "link", "node_modules/.bin")), self.target)
+        with open(os.path.join(self.target, "current", "tool")) as tool:
+            self.assertEqual(tool.read(), "run()")
+
+
+if __name__ == "__main__":
+    unittest.main()

{withruntime-0.7.1 → withruntime-0.7.2}/withruntime/_async_client.py

@@ -22,6 +22,7 @@ from ._errors import WAITS_FOR_ROOM, CommandError, ConnectionError, RuntimeError
 from ._http import AsyncHTTP as HTTP
 from ._http import Origin
 from ._proxy import describe as describe_route
+from ._unpack import unpack_archive
 from ._ws import AsyncWebSocket as WebSocket
 from ._tunnel import AsyncPortForward
 from ._tunnel import async_open_forward as open_forward
@@ -637,8 +638,9 @@ class AsyncFiles:
         return (await self.read(path)).decode(encoding)
 
     async def write(self, path: str, data: Union[str, bytes], mode: Optional[int] = None) -> dict[str, Any]:
-        """Writes a file of any size, atomically, making parent directories.
-        Large files go in parallel 1 MiB chunks checked against their SHA-256.
+        """Writes a file, atomically, making parent directories. Under
+        /workspace any size, large ones in parallel 1 MiB chunks checked against
+        their SHA-256; elsewhere, with the sandbox user's rights, up to 1 MiB.
         ``mode`` sets its permissions (0o755 for a program); 0o644 when left out."""
         payload = data.encode() if isinstance(data, str) else bytes(data)
         octal = None if mode is None else format(mode & 0o777, "03o")
@@ -752,22 +754,12 @@ class AsyncFiles:
             os.makedirs(os.path.dirname(os.path.abspath(local_path)), exist_ok=True)
             await self._stream_to(remote_path, local_path)
             return
-        import io
-        import tarfile
         staging = f"/tmp/.runtime-download-{uuid.uuid4().hex}.tar.gz"
         packed = await AsyncSandbox(self._t, {"id": self._id}).exec(["tar", "-czf", staging, "-C", remote_path, "."])
         if packed.exit_code != 0:
             raise CommandError(packed.to_dict())
         try:
-            data = await self.read(staging)
-            os.makedirs(local_path, exist_ok=True)
-            root = os.path.realpath(local_path)
-            with tarfile.open(fileobj=io.BytesIO(data), mode="r:gz") as archive:
-                for member in archive.getmembers():
-                    destination = os.path.realpath(os.path.join(root, member.name))
-                    if destination != root and not destination.startswith(root + os.sep):
-                        raise RuntimeError(f"Refusing an archive entry outside the target: {member.name}", code="unsafe_archive")
-                archive.extractall(root)  # noqa: S202 - every member checked above
+            unpack_archive(await self.read(staging), local_path)
         finally:
             try:
                 await self.remove(staging)
@@ -815,7 +807,8 @@ class AsyncSandbox:
                    on_stderr: Optional[Callable[[str], Any]] = None, check: bool = False,
                    idempotency_key: Optional[str] = None) -> CommandResult:
         """Runs a command: a string under ``bash -c``, a list without a shell.
-        With on_stdout/on_stderr the output streams. A timeout is a result
+        With on_stdout/on_stderr the output streams. The timeout is 60 s by
+        default, 24 h when the output streams. A timeout is a result
         (timed_out=True, the output so far), never an error; ``check=True``
         raises CommandError on a non-zero exit."""
         streaming = on_stdout is not None or on_stderr is not None or (timeout_ms or 0) > 60_000
@@ -1283,7 +1276,9 @@ class AsyncRuntime:
         microdollars in strings (1,000,000 = $1): ``credited``, ``spent``,
         ``held``, ``expired``, ``available`` (credited - spent - expired - held)
         and ``takenBack`` (the part of spent that refunds and disputes took);
-        ``trial`` is in milliseconds, or None."""
+        ``trial`` is in milliseconds, or None; ``outbound`` is this month's
+        outbound traffic in bytes, with ``chargedMicros`` for what went past
+        the free 100 GiB."""
         return await self._t.json("GET", "/v1/usage")
 
     async def request(self, method: str, path: str, **kwargs: Any) -> Any:

{withruntime-0.7.1 → withruntime-0.7.2}/withruntime/_eval_sandbox.py

@@ -27,7 +27,8 @@ logger = logging.getLogger("withruntime")
 # by an older builder is not reused. runtime-builder/3 gives uid 1000 sudo in
 # images built from a public image (ARCHITECTURE.md section 10, "Root in images
 # built from a public image"); images tagged before it may have none.
-IMAGE_RECIPE = "runtime-builder/3"
+# runtime-builder/4 (26 September 2026) fixed that sudo's -s, -i and VAR=value.
+IMAGE_RECIPE = "runtime-builder/4"
 
 
 def image_tag(key: str) -> str:

{withruntime-0.7.1 → withruntime-0.7.2}/withruntime/_sync_client.py

@@ -21,6 +21,7 @@ from ._errors import WAITS_FOR_ROOM, CommandError, ConnectionError, RuntimeError
 from ._http import SyncHTTP as HTTP
 from ._http import Origin
 from ._proxy import describe as describe_route
+from ._unpack import unpack_archive
 from ._ws import SyncWebSocket as WebSocket
 from ._tunnel import PortForward
 from ._tunnel import sync_open_forward as open_forward
@@ -636,8 +637,9 @@ class Files:
         return (self.read(path)).decode(encoding)
 
     def write(self, path: str, data: Union[str, bytes], mode: Optional[int] = None) -> dict[str, Any]:
-        """Writes a file of any size, atomically, making parent directories.
-        Large files go in parallel 1 MiB chunks checked against their SHA-256.
+        """Writes a file, atomically, making parent directories. Under
+        /workspace any size, large ones in parallel 1 MiB chunks checked against
+        their SHA-256; elsewhere, with the sandbox user's rights, up to 1 MiB.
         ``mode`` sets its permissions (0o755 for a program); 0o644 when left out."""
         payload = data.encode() if isinstance(data, str) else bytes(data)
         octal = None if mode is None else format(mode & 0o777, "03o")
@@ -751,22 +753,12 @@ class Files:
             os.makedirs(os.path.dirname(os.path.abspath(local_path)), exist_ok=True)
             self._stream_to(remote_path, local_path)
             return
-        import io
-        import tarfile
         staging = f"/tmp/.runtime-download-{uuid.uuid4().hex}.tar.gz"
         packed = Sandbox(self._t, {"id": self._id}).exec(["tar", "-czf", staging, "-C", remote_path, "."])
         if packed.exit_code != 0:
             raise CommandError(packed.to_dict())
         try:
-            data = self.read(staging)
-            os.makedirs(local_path, exist_ok=True)
-            root = os.path.realpath(local_path)
-            with tarfile.open(fileobj=io.BytesIO(data), mode="r:gz") as archive:
-                for member in archive.getmembers():
-                    destination = os.path.realpath(os.path.join(root, member.name))
-                    if destination != root and not destination.startswith(root + os.sep):
-                        raise RuntimeError(f"Refusing an archive entry outside the target: {member.name}", code="unsafe_archive")
-                archive.extractall(root)  # noqa: S202 - every member checked above
+            unpack_archive(self.read(staging), local_path)
         finally:
             try:
                 self.remove(staging)
@@ -814,7 +806,8 @@ class Sandbox:
                    on_stderr: Optional[Callable[[str], Any]] = None, check: bool = False,
                    idempotency_key: Optional[str] = None) -> CommandResult:
         """Runs a command: a string under ``bash -c``, a list without a shell.
-        With on_stdout/on_stderr the output streams. A timeout is a result
+        With on_stdout/on_stderr the output streams. The timeout is 60 s by
+        default, 24 h when the output streams. A timeout is a result
         (timed_out=True, the output so far), never an error; ``check=True``
         raises CommandError on a non-zero exit."""
         streaming = on_stdout is not None or on_stderr is not None or (timeout_ms or 0) > 60_000
@@ -1282,7 +1275,9 @@ class Runtime:
         microdollars in strings (1,000,000 = $1): ``credited``, ``spent``,
         ``held``, ``expired``, ``available`` (credited - spent - expired - held)
         and ``takenBack`` (the part of spent that refunds and disputes took);
-        ``trial`` is in milliseconds, or None."""
+        ``trial`` is in milliseconds, or None; ``outbound`` is this month's
+        outbound traffic in bytes, with ``chargedMicros`` for what went past
+        the free 100 GiB."""
         return self._t.json("GET", "/v1/usage")
 
     def request(self, method: str, path: str, **kwargs: Any) -> Any:

withruntime-0.7.2/withruntime/_unpack.py

@@ -0,0 +1,99 @@
+"""Unpacks a directory download without letting the archive write outside it.
+
+The archive comes from a sandbox, whose contents the customer's untrusted code
+controls. Checking each name before extracting is not enough: a link
+``x -> ../outside`` followed by ``x/file`` passes that check and writes through
+the link, and ``tarfile``'s own ``data`` filter depends on the interpreter's
+patch release. So no write ever passes through a link, links are made only after
+every file and directory is in place, and each link is then walked through the
+finished tree and removed, failing the unpack, if it leads out. The JavaScript
+SDK's ``unpackArchive`` in ``packages/cloud-sdk/src/tar.ts`` keeps the same rules.
+"""
+from __future__ import annotations
+
+import io
+import os
+import tarfile
+
+from ._errors import RuntimeError
+
+
+def _refuse(message: str) -> RuntimeError:
+    return RuntimeError(message, code="unsafe_archive")
+
+
+def _inside(root: str, path: str) -> bool:
+    return path == root or path.startswith(root + os.sep)
+
+
+def _assert_plain(root: str, destination: str, name: str) -> None:
+    """Refuses unless ``destination`` is inside ``root`` and no part of the way
+    to it, itself included, is a link."""
+    if not _inside(root, destination):
+        raise _refuse(f"Refusing an archive entry outside the target: {name}")
+    path = root
+    for part in os.path.relpath(destination, root).split(os.sep):
+        if part in ("", "."):
+            continue
+        path = os.path.join(path, part)
+        if os.path.islink(path):
+            raise _refuse(f"Refusing an archive entry that passes through a link: {name}")
+
+
+def _link_stays_inside(root: str, directory: str, link: str) -> bool:
+    """Whether following ``link`` from ``directory`` stays in ``root`` without
+    turning at a link before its last step. The last step may be a link; that
+    link is checked on its own."""
+    if os.path.isabs(link):
+        return False
+    parts = [part for part in link.split("/") if part not in ("", ".")]
+    path = directory
+    for index, part in enumerate(parts):
+        path = os.path.dirname(path) if part == ".." else os.path.join(path, part)
+        if not _inside(root, path):
+            return False
+        if index < len(parts) - 1 and part != ".." and os.path.islink(path):
+            return False
+    return True
+
+
+def unpack_archive(data: bytes, target: str) -> None:
+    """Unpacks a gzipped tar into ``target``, refusing any entry that would
+    land outside it."""
+    os.makedirs(target, exist_ok=True)
+    root = os.path.realpath(target)
+    links: list[tuple[str, str, str]] = []
+    with tarfile.open(fileobj=io.BytesIO(data), mode="r:gz") as archive:
+        for member in archive:
+            name = member.name
+            while name.startswith("./"):
+                name = name[2:]
+            if name in ("", "."):
+                continue
+            destination = os.path.normpath(os.path.join(root, name))
+            _assert_plain(root, destination, name)
+            if member.isdir():
+                os.makedirs(destination, exist_ok=True)
+            elif member.issym():
+                links.append((destination, member.linkname, name))
+            elif member.isfile():
+                os.makedirs(os.path.dirname(destination), exist_ok=True)
+                source = archive.extractfile(member)
+                with open(destination, "wb") as out:
+                    out.write(source.read() if source else b"")
+                os.chmod(destination, member.mode & 0o777)
+    for destination, link, name in links:
+        _assert_plain(root, destination, name)
+        os.makedirs(os.path.dirname(destination), exist_ok=True)
+        try:
+            os.symlink(link, destination)
+        except FileExistsError:
+            pass
+    for destination, link, name in links:
+        if _link_stays_inside(root, os.path.dirname(destination), link):
+            continue
+        try:
+            os.unlink(destination)
+        except OSError:
+            pass
+        raise _refuse(f"Refusing an archive link that leads outside the target: {name} -> {link}")

withruntime-0.7.2/withruntime/_version.py

@@ -0,0 +1 @@
+VERSION = "0.7.2"

{withruntime-0.7.1 → withruntime-0.7.2}/withruntime/harbor.py

@@ -55,6 +55,7 @@ except ImportError:  # pragma: no cover - older Harbor
 from ._async_client import AsyncRuntime, AsyncSandbox
 from ._errors import NotFoundError
 from ._errors import RuntimeError as RuntimeCloudError
+from ._unpack import unpack_archive
 from ._eval_sandbox import (_TRANSFER_TIMEOUT_S, MissingSudoError, _file_error, _missing_sudo, _Shell, _sizes,
                             dockerfile_workdir, ensure_image, image_name, image_tag)
 
@@ -302,8 +303,7 @@ class RuntimeEnvironment(BaseEnvironment):
             await shell.remove(staging)
         target = Path(target_dir)
         target.mkdir(parents=True, exist_ok=True)
-        with tarfile.open(fileobj=io.BytesIO(data), mode="r:gz") as archive:
-            archive.extractall(target, filter="data")
+        unpack_archive(data, str(target))
 
 
 __all__ = ["ENVIRONMENT_TYPE", "MissingSudoError", "RuntimeEnvironment"]

{withruntime-0.7.1 → withruntime-0.7.2/withruntime.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: withruntime
-Version: 0.7.1
+Version: 0.7.2
 Summary: Runtime Cloud: one client (sync and async) for every Runtime product. Sandboxes first.
 License: Apache-2.0
 Project-URL: Homepage, https://withruntime.com

{withruntime-0.7.1 → withruntime-0.7.2}/withruntime.egg-info/SOURCES.txt

@@ -36,6 +36,7 @@ tests/test_snapshot_after_fork.py
 tests/test_sso.py
 tests/test_switching.py
 tests/test_tools.py
+tests/test_unpack.py
 tests/test_vercel.py
 tests/test_volume_backups.py
 tests/test_wake_awake.py
@@ -51,6 +52,7 @@ withruntime/_http.py
 withruntime/_proxy.py
 withruntime/_sync_client.py
 withruntime/_tunnel.py
+withruntime/_unpack.py
 withruntime/_version.py
 withruntime/_ws.py
 withruntime/deepagents.py

withruntime-0.7.1/withruntime/_version.py

@@ -1 +0,0 @@
-VERSION = "0.7.1"