qi7 VddlZddlZddlmZdZdZdZdZdZdZ dZ d Z d Z y) Nctjt5tjddddtjt5tjddddy#1swYAxYw#1swYyxYw)z3No-protocol traversal sequences should be rejected.../../etc/passwdNz../relative/../etc/passwdpytestraises ValueErrordatanormalize_resource_urlS/opt/pipecat/venv/lib/python3.12/site-packages/nltk/test/unit/test_data_security.py,test_normalize_rejects_no_protocol_traversalrsn z "8 ##$678 z "A ##$?@AA88AAA0A<0A9<Bctjt5tjddddy#1swYyxYw)zQWindows-style backslash traversal should be rejected when no protocol is present.z..\..\etc\passwdNrr r r .test_normalize_rejects_no_protocol_backslashesrs2 z "9 ##$78999 9Ac^tjd}|jdsJdy)zIValid package-style resource names should still be treated as nltk: URLs.z corpora/brownznltk:z5Package-style paths should be treated as 'nltk:' URLsN)r r startswith)outs r #test_normalize_allows_package_pathsrs3  % %o 6C >> ?>? r ctjt5tjddddy#1swYyxYw)zLDefense-in-depth: direct calls to find() should reject traversal-like names.rNrrrr findr r r 'test_find_rejects_traversal_direct_callrs0 z "& $%&&&rctjt5tjddddy#1swYyxYw)z Defense-in-depth edge case: a path can become unsafe only after normalization. Example from review: "foo/../../etc/passwd" normalizes to "../etc/passwd" and must still be rejected. zfoo/../../etc/passwdNrr r r Ctest_find_rejects_traversal_that_becomes_unsafe_after_normalizationr%s2 z "* ()***rctjt5tjddddy#1swYyxYw)z;Absolute POSIX paths without a protocol should be rejected.z /etc/passwdNrr r r 6test_normalize_rejects_no_protocol_absolute_posix_pathr0s1 z "3 ##M2333rctjt5tjddddtjt5tjddddy#1swYAxYw#1swYyxYw)z Windows drive letter paths should be rejected even on non-Windows platforms. Review note: don't gate 'C:/etc/passwd' on Windows only; ensure robust rejection regardless of runtime platform. z C:\etc\passwdNz C:/etc/passwdrr r r =test_normalize_rejects_no_protocol_windows_drive_letter_pathsr 6sj z "6 ##$456 z "5 ##O455 6655rctjt5tjddddy#1swYyxYw)z8A resource name that is exactly '..' should be rejected.z..Nrr r r .test_normalize_rejects_no_protocol_dotdot_onlyr"Es1 z "* ##D)***rc|dz }tj|d5}|jdddddtjdt |g}|j 5}|j}t|tr|jd}|dk(sJ dddy#1swY}xYw#1swYyxYw)Nza.zipwz b.zip/c.txtokza.zip/b.zip/c.txt)pathszutf-8) zipfileZipFilewritestrr rstropenread isinstancebytesdecode)tmp_pathzpathzfptrfgots r !test_find_zip_split_is_non_greedyr6Ks w E  $) M4() ))'H  ?C qffh c5 !**W%Cd{{  ))sB+(9B7+B47C) r'r nltk.datar rrrrrrr r"r6r r r r8s< A9 ?& *3 5* r