security: tighten readable/regular file checks in CLI tools

docs/showcase/run.py

@@ -5,10 +5,15 @@ from pathlib import Path
 
 
 def _jsonl_path(arg):
-    """Resolve the CLI file argument; require an existing regular file."""
+    """Resolve the CLI file argument; require an existing readable regular file."""
     path = Path(arg).resolve()
     if not path.is_file():
         sys.exit(f"not a readable file: {arg}")
+    try:
+        with path.open("rb"):
+            pass
+    except OSError:
+        sys.exit(f"not a readable file: {arg}")
     return path
 
 def call(method, params):

tools/spectral_camera_table.py

@@ -35,6 +35,8 @@ def _out_path(arg):
     path = Path(arg).resolve()
     if not path.parent.is_dir():
         sys.exit(f"output directory does not exist: {arg}")
+    if path.exists() and not path.is_file():
+        sys.exit(f"output path is not a regular file: {arg}")
     return str(path)
 
 WL = np.arange(380, 781, 5)