From 4395d4001c265ff9e040da18d34fed8d9b16fd73 Mon Sep 17 00:00:00 2001 From: Beth Probert Date: Fri, 6 Mar 2026 14:13:00 +0000 Subject: [PATCH] Allow relative imports with two dots at start of path. Update unit tests. --- src/openflexure_microscope_server/utilities.py | 10 +++++----- tests/unit_tests/test_utilities.py | 9 ++++----- 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/src/openflexure_microscope_server/utilities.py b/src/openflexure_microscope_server/utilities.py index c4b328d4..5fa1db8f 100644 --- a/src/openflexure_microscope_server/utilities.py +++ b/src/openflexure_microscope_server/utilities.py @@ -140,11 +140,11 @@ def make_path_safe(unsafe_path_string: str) -> str: for i, component in enumerate(components): if component in ("/", "\\"): sanitised_components.append(component) - elif component == ".": - # Only allow '.' if its the very first - # element and the next element is a separator. - # This allows for relative paths like "./file" - # but not "file./file" + elif component in (".", ".."): + # Only allow '.' and '..' if they are the very first + # elements and the next element is a separator. + # This allows for relative paths like "./file" or "../file" + # but not "file./file" or "file/../file" is_first = i == 0 next_to_sep = (i + 1 < len(components)) and ( components[i + 1] in ("/", "\\") diff --git a/tests/unit_tests/test_utilities.py b/tests/unit_tests/test_utilities.py index 84c25dc3..52b94fad 100644 --- a/tests/unit_tests/test_utilities.py +++ b/tests/unit_tests/test_utilities.py @@ -95,13 +95,12 @@ def test_make_path_safe_separators(): def test_make_path_safe_relative(): - """Test that relative path components are preserved. - We only allow relative paths with one dot, and at the beginning of the path, - to avoid issues with paths like "file./file" or "file../file - """ + """Test that relative path components are preserved.""" + # We only allow relative paths with one dot, and at the beginning of the path, + # to avoid issues with paths like "file./file" or "file../file. assert make_path_safe("./openflexure/data/") == "./openflexure/data/" + assert make_path_safe("../openflexure/data/") == "../openflexure/data/" - assert make_path_safe("../openflexure/data/") == "_/openflexure/data/" assert make_path_safe("path/./to/file") == "path/_/to/file" assert make_path_safe("path/../to/file") == "path/_/to/file" assert make_path_safe(".") == "_"