Python 输出路径预检：用 pathlib 拒绝目录越界与误覆盖

python3 - <<'PYCODE'
from pathlib import Path
root = Path("/tmp/exports")
other = Path("/tmp/exports-old/report.txt")
print(str(other).startswith(str(root)))
try:
    other.relative_to(root)
except ValueError:
    print("Not a child directory")
PYCODE

python3 --version
mkdir output-path-demo
cd output-path-demo
mkdir -p exports/daily outside
ln -s ../outside exports/escape

import argparse
import json
from pathlib import Path
import sys


def output_path(root_name, name):
    root = Path(root_name).resolve(strict=True)
    if not root.is_dir():
        raise ValueError("output root must be a directory")
    relative = Path(name)
    if not name or relative == Path("."):
        raise ValueError("a file name is required")
    if relative.is_absolute() or ".." in relative.parts:
        raise ValueError("use a relative path without '..'")
    target = (root / relative).resolve(strict=False)
    try:
        local = target.relative_to(root)
    except ValueError:
        raise ValueError("resolved path leaves output root") from None
    if local == Path("."):
        raise ValueError("target must not be the output root")
    if not target.parent.is_dir():
        raise ValueError("output parent directory must already exist")
    return root, target


def main():
    parser = argparse.ArgumentParser(
        description="Create a demo file inside a trusted Linux output tree."
    )
    parser.add_argument("root", help="existing output directory")
    parser.add_argument("name", help="relative output filename")
    args = parser.parse_args()
    try:
        root, target = output_path(args.root, args.name)
        with target.open("x", encoding="utf-8", newline="\n") as stream:
            stream.write("demo output\n")
    except (OSError, ValueError, RuntimeError) as exc:
        print(f"ERROR: {exc}", file=sys.stderr)
        return 1
    print(json.dumps({"status": "created", "path": target.relative_to(root).as_posix()}))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

python3 safe_output.py --help
python3 safe_output.py exports 'daily/report 01.txt'
cat 'exports/daily/report 01.txt'

{"status": "created", "path": "daily/report 01.txt"}
demo output

for name in '../outside/no.txt' '/tmp/no.txt' 'escape/no.txt'; do
  if python3 safe_output.py exports "$name"; then
    printf 'Unexpected success: %s\n' "$name"
  else
    printf 'Rejected as expected: %s\n' "$name"
  fi
done

python3 safe_output.py "$PWD/exports" 'daily/from-job.txt'

import json
from pathlib import Path
import subprocess
import sys
import tempfile

script = Path(__file__).with_name("safe_output.py").resolve()


def run(args, cwd):
    return subprocess.run(
        [sys.executable, str(script), *args], cwd=cwd,
        capture_output=True, text=True, timeout=10, check=False,
    )


with tempfile.TemporaryDirectory(prefix="output-path-test-") as tmp:
    base = Path(tmp).resolve()
    root = base / "exports"
    (root / "daily").mkdir(parents=True)
    outside = base / "exports-old"
    outside.mkdir()
    sentinel = outside / "keep.txt"
    sentinel.write_bytes(b"unchanged\n")
    (root / "escape").symlink_to(outside, target_is_directory=True)
    (root / "dangling").symlink_to(outside / "new.txt")
    (root / "alias").symlink_to(root / "daily", target_is_directory=True)
    (root / "loop").symlink_to("loop")

    def call(name):
        return run([str(root), name], base)

    good = call("daily/report 01.txt")
    assert (good.returncode, good.stderr) == (0, ""), good
    assert json.loads(good.stdout) == {"status": "created", "path": "daily/report 01.txt"}
    saved = root / "daily/report 01.txt"
    assert saved.read_bytes() == b"demo output\n"

    alias = call("alias/second.txt")
    assert alias.returncode == 0 and not alias.stderr, alias
    assert json.loads(alias.stdout)["path"] == "daily/second.txt"

    bad_names = [
        "", ".", "daily/..", "../exports-old/new.txt", str(sentinel),
        "escape/keep.txt", "escape/new.txt", "dangling", "loop/new.txt",
        "missing/new.txt", "daily/report 01.txt", "daily",
    ]
    for name in bad_names:
        result = call(name)
        assert result.returncode == 1 and not result.stdout, (name, result)
        assert result.stderr.startswith("ERROR:"), (name, result)

    for bad_root in [base / "absent", sentinel]:
        result = run([str(bad_root), "new.txt"], base)
        assert result.returncode == 1 and result.stderr.startswith("ERROR:"), result
    help_result = run(["--help"], base)
    assert help_result.returncode == 0 and "trusted Linux" in help_result.stdout
    missing = run([], base)
    assert missing.returncode == 2 and "required" in missing.stderr
    assert sentinel.read_bytes() == b"unchanged\n"
    assert not (outside / "new.txt").exists()
    assert saved.read_bytes() == b"demo output\n"
    assert sorted(p.name for p in (root / "daily").iterdir()) == ["report 01.txt", "second.txt"]

print("OK: contained writes, aliases, traversal, symlinks, loops, existing files, roots, CLI")

python3 verify_output.py

OK: contained writes, aliases, traversal, symlinks, loops, existing files, roots, CLI