Repository navigation
fix(frontend): validate in-tree backend paths - #320
Merged
gaborbernat merged 2 commits intoOct 16, 2026
Merged
Conversation
Move the backend-path validation into a helper so the config reader keeps its one-line tuple build. Resolve the project root inside the try, so a resolution failure there also surfaces as the documented ValueError, and drop ValueError from the caught types: the explicit NUL check covers it. Python 3.15 on Windows resolves a NUL-containing path without raising, so that check has to stay. Tests: table-drive the rejected entries with pytest.param ids, add a symlink pointing outside the project, and patch Path.resolve with an autospec mock instead of a hand-written replacement.
gaborbernat
changed the title
gaborbernat
enabled auto-merge (squash)
October 16, 2026 01:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
create_args_from_folder()currently accepts backend paths outside the project, such as../outside, and passes them through to the backend subprocess. Validate the in-tree backend path constraint while reading configuration: reject absolute entries, embedded NUL, resolution errors and resolved targets outside the root. Valid entries retain their existing path values.Adds regressions and documents the contextual ValueError. This is configuration/spec-conformance validation for build input; build backends already execute project-supplied code.
Validation: root and independent focused runs: 14 passed; full suite: 87 passed and one existing Windows symlink-privilege failure (WinError 1314). Pre-commit, type checks and Sphinx warnings-as-errors pass. A local coverage run with the privilege-blocked test deselected reached 97.37%, so the full 100% gate is not claimed locally. A manual Windows junction case was also rejected as expected.