Repository navigation
Bump path_jail core to 0.5 (release 0.3.0) - #1
Merged
Merged
Conversation
- Depend on path_jail 0.5 (from 0.2). The core now fails closed when an existing path component cannot be inspected: join/contains/relative raise OSError (e.g. permission denied) instead of treating it as nonexistent. - Map InvalidRoot explicitly to ValueError without the generic prefix. - Fix exception docs (docstrings, stubs, README): a non-directory or filesystem root raises ValueError; a missing root raises OSError. - README: O_NOFOLLOW write snippet for the TOCTOU section, note that the core's guard API is not exposed yet; FastAPI example imports Path; examples formatted with ruff. - __version__ reads package metadata (was stuck at 0.1.0). - Homepage/author domain: tenuo.dev -> tenuo.ai. - Tests: non-directory root, unreadable component, version metadata.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the bindings from
path_jail0.2 to 0.5.0 and bumps the package to 0.3.0.The bindings wrap only the path-based API (
Jail,join,contains,relative), so the core upgrade needs no binding code changes. One core behavior change reaches Python:join/contains/relativenow raiseOSError(e.g. permission denied) when an existing component cannot be inspected. 0.2 treated it as nonexistent and returned a path.Also
InvalidRootis mapped explicitly toValueError(drops the genericpath_jail error:prefix)..pyistubs and the README: a non-directory or filesystem root raisesValueError; a missing root raisesOSError. The README previously saidOSErrorfor both.O_NOFOLLOWwrite snippet and notes that the core'sguardAPI is not exposed yet. The FastAPI example now importsPath. Examples are reformatted byruff format(whitespace only), which CI's unpinned ruff now checks in Markdown.__version__reads package metadata (it was stuck at0.1.0).tenuo.dev→tenuo.ai, matching the core crate.Tests
New: non-directory root →
ValueError, unreadable component →OSError(POSIX, non-root),__version__matches metadata.Local (macOS arm64, Python 3.13):
maturin develop --release,pytest48 passed,cargo fmt --check,cargo clippy -D warnings,ruff check,ruff format --check,mypy.Release
After merge, pushing tag
v0.3.0runsrelease.yml(Linux/macOS/Windows wheels + sdist → PyPI).