Raise exception for uninstalled LoadImage reader and print writer pkg…

README.md

@@ -30,6 +30,7 @@ Its ambitions are as follows:
 
 - flexible pre-processing for multi-dimensional medical imaging data;
 - compositional & portable APIs for ease of integration in existing workflows;
+- secure archive extraction utilities with built-in path-traversal protection;
 - domain-specific implementations for networks, losses, evaluation metrics and more;
 - customizable design for varying user expertise;
 - multi-GPU multi-node data parallelism support.
@@ -75,7 +76,7 @@ If you have used MONAI in your research, please cite us! The citation can be exp
 
 ## Model Zoo
 
-[The MONAI Model Zoo](https://github.com/Project-MONAI/model-zoo) is a place for researchers and data scientists to share the latest and great models from the community.
+[The MONAI Model Zoo](https://github.com/Project-MONAI/model-zoo) is a place for researchers and data scientists to share the latest and greatest models from the community.
 Utilizing [the MONAI Bundle format](https://monai.readthedocs.io/en/latest/bundle_intro.html) makes it easy to [get started](https://github.com/Project-MONAI/tutorials/tree/main/model_zoo) building workflows with MONAI.
 
 ## Contributing

monai/apps/pathology/engines/utils.py

@@ -51,6 +51,15 @@ def __call__(
         https://pytorch.org/ignite/v0.4.8/generated/ignite.engine.create_supervised_trainer.html.
         `kwargs` supports other args for `Tensor.to()` API.
         """
+        # Validate that all extra_keys exist in batchdata to provide a helpful error message
+        if isinstance(self.prepare_batch.extra_keys, (list, tuple)):
+            for key in self.prepare_batch.extra_keys:
+                if key not in batchdata:
+                    raise KeyError(
+                        f"PrepareBatchHoVerNet: extra_key '{key}' not found in batchdata. "
+                        f"Available keys are: {list(batchdata.keys())}"
+                    )
+
         image, _label, extra_label, _ = self.prepare_batch(batchdata, device, non_blocking, **kwargs)
         label = {HoVerNetBranch.NP: _label, HoVerNetBranch.NC: extra_label[0], HoVerNetBranch.HV: extra_label[1]}
 

monai/apps/utils.py

@@ -119,6 +119,11 @@ def update_to(self, b: int = 1, bsize: int = 1, tsize: int | None = None) -> Non
             urlretrieve(url, filepath)
     except (URLError, HTTPError, ContentTooShortError, OSError) as e:
         logger.error(f"Download failed from {url} to {filepath}.")
+        if filepath.exists():
+            try:
+                filepath.unlink()
+            except OSError:
+                pass
         raise e
 
 
@@ -133,13 +138,16 @@ def safe_extract_member(member, extract_to):
         member_path = str(member)
 
     if hasattr(member, "issym") and member.issym():
+        logger.warning(f"Unsafe path guard: Symbolic link blocked: {member_path}")
         raise ValueError(f"Symbolic link detected in archive: {member_path}")
     if hasattr(member, "islnk") and member.islnk():
+        logger.warning(f"Unsafe path guard: Hard link blocked: {member_path}")
         raise ValueError(f"Hard link detected in archive: {member_path}")
 
     member_path = os.path.normpath(member_path)
 
     if os.path.isabs(member_path) or ".." in member_path.split(os.sep):
+        logger.warning(f"Unsafe path guard: Absolute/relative path traversal blocked: {member_path}")
         raise ValueError(f"Unsafe path detected in archive: {member_path}")
 
     full_path = os.path.join(extract_to, member_path)
@@ -148,8 +156,14 @@ def safe_extract_member(member, extract_to):
     extract_root = os.path.realpath(extract_to)
     target_real = os.path.realpath(full_path)
     # Ensure the resolved path stays within the extraction root
-    if os.path.commonpath([extract_root, target_real]) != extract_root:
-        raise ValueError(f"Unsafe path: path traversal {member_path}")
+    try:
+        # On Windows, comparing paths on different drives raises ValueError in commonpath
+        if os.path.commonpath([extract_root, target_real]) != extract_root:
+            logger.warning(f"Unsafe path guard: Out-of-bounds path traversal blocked: {member_path}")
+            raise ValueError(f"Unsafe path: path traversal {member_path}")
+    except ValueError as e:
+        logger.warning(f"Unsafe path guard: Out-of-bounds path traversal blocked due to drive mismatch or invalid paths: {member_path}")
+        raise ValueError(f"Unsafe path: path traversal {member_path}") from e
 
     return full_path
 

monai/data/image_writer.py

@@ -107,16 +107,32 @@ def resolve_writer(ext_name, error_if_not_found=True) -> Sequence:
         fmt = fmt[1:]
     avail_writers = []
     default_writers = SUPPORTED_WRITERS.get(EXT_WILDCARD, ())
+    import re
+    errors = []
     for _writer in look_up_option(fmt, SUPPORTED_WRITERS, default=default_writers):
         try:
             _writer()  # this triggers `monai.utils.module.require_pkg` to check the system availability
             avail_writers.append(_writer)
-        except OptionalImportError:
+        except OptionalImportError as e:
+            errors.append(str(e))
             continue
         except Exception:  # other writer init errors indicating it exists
             avail_writers.append(_writer)
     if not avail_writers and error_if_not_found:
-        raise OptionalImportError(f"No ImageWriter backend found for {fmt}.")
+        required_pkgs = []
+        for err in errors:
+            match = re.search(r"required package `([^`]+)`", err)
+            if match:
+                pkg = match.group(1)
+                pkg = "pillow" if pkg == "PIL" else pkg
+                pkg = "pynrrd" if pkg == "nrrd" else pkg
+                if pkg not in required_pkgs:
+                    required_pkgs.append(pkg)
+
+        msg = f"No ImageWriter backend found for {fmt}."
+        if required_pkgs:
+            msg += f" Please install: {' or '.join(required_pkgs)}."
+        raise OptionalImportError(msg)
     writer_tuple = ensure_tuple(avail_writers)
     SUPPORTED_WRITERS[fmt] = writer_tuple
     return writer_tuple

monai/transforms/io/array.py

@@ -209,13 +209,18 @@ def __init__(
                     the_reader = look_up_option(_r.lower(), SUPPORTED_READERS)
                 try:
                     self.register(the_reader(*args, **kwargs))
-                except OptionalImportError:
-                    warnings.warn(
+                except OptionalImportError as e:
+                    raise OptionalImportError(
                         f"required package for reader {_r} is not installed, or the version doesn't match requirement."
-                    )
+                    ) from e
                 except TypeError:  # the reader doesn't have the corresponding args/kwargs
                     warnings.warn(f"{_r} is not supported with the given parameters {args} {kwargs}.")
-                    self.register(the_reader())
+                    try:
+                        self.register(the_reader())
+                    except OptionalImportError as e:
+                        raise OptionalImportError(
+                            f"required package for reader {_r} is not installed, or the version doesn't match requirement."
+                        ) from e
             elif inspect.isclass(_r):
                 self.register(_r(*args, **kwargs))
             else:

tests/data/test_image_rw.py

@@ -139,8 +139,18 @@ def test_rgb(self, reader, writer):
 class TestRegRes(unittest.TestCase):
     def test_0_default(self):
         self.assertTrue(len(resolve_writer(".png")) > 0, "has png writer")
-        self.assertTrue(len(resolve_writer(".nrrd")) > 0, "has nrrd writer")
-        self.assertTrue(len(resolve_writer("unknown")) > 0, "has writer")
+        _, has_nibabel = optional_import("nibabel")
+        _, has_itk = optional_import("itk", allow_namespace_pkg=True)
+        if has_nibabel or has_itk:
+            self.assertTrue(len(resolve_writer(".nrrd")) > 0, "has nrrd writer")
+            self.assertTrue(len(resolve_writer("unknown")) > 0, "has writer")
+        else:
+            with self.assertRaises(OptionalImportError) as ctx:
+                resolve_writer(".nrrd")
+            self.assertIn("Please install: itk or nibabel.", str(ctx.exception))
+            with self.assertRaises(OptionalImportError) as ctx:
+                resolve_writer("unknown")
+            self.assertIn("Please install: itk or nibabel.", str(ctx.exception))
         register_writer("unknown1", lambda: (_ for _ in ()).throw(OptionalImportError))
         with self.assertRaises(OptionalImportError):
             resolve_writer("unknown1")

tests/data/test_init_reader.py

@@ -29,9 +29,28 @@ def test_load_image(self):
         self.assertIsInstance(instance1, LoadImage)
         self.assertIsInstance(instance2, LoadImage)
 
+        from monai.utils import optional_import, OptionalImportError
+        pkg_map = {
+            "NibabelReader": "nibabel",
+            "PILReader": "PIL",
+            "ITKReader": "itk",
+            "NrrdReader": "nrrd",
+            "NumpyReader": "numpy",
+            "PydicomReader": "pydicom",
+        }
         for r in ["NibabelReader", "PILReader", "ITKReader", "NumpyReader", "NrrdReader", "PydicomReader", None]:
-            inst = LoadImaged("image", reader=r)
-            self.assertIsInstance(inst, LoadImaged)
+            if r is None:
+                inst = LoadImaged("image", reader=r)
+                self.assertIsInstance(inst, LoadImaged)
+                continue
+
+            _, has_pkg = optional_import(pkg_map[r])
+            if has_pkg:
+                inst = LoadImaged("image", reader=r)
+                self.assertIsInstance(inst, LoadImaged)
+            else:
+                with self.assertRaises(OptionalImportError):
+                    LoadImaged("image", reader=r)
 
     @SkipIfNoModule("nibabel")
     @SkipIfNoModule("cupy")