From ac2d7623e3dc5b0188a45571e6ac45ada45650cf Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Thu, 22 Oct 2026 19:18:41 -0400 Subject: [PATCH] security: tighten readable/regular file checks in CLI tools --- docs/showcase/run.py | 7 ++++++- tools/spectral_camera_table.py | 2 ++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/showcase/run.py b/docs/showcase/run.py index 6b680e9f2..bb80e0c1c 100644 --- a/docs/showcase/run.py +++ b/docs/showcase/run.py @@ -5,10 +5,15 @@ from pathlib import Path def _jsonl_path(arg): - """Resolve the CLI file argument; require an existing regular file.""" + """Resolve the CLI file argument; require an existing readable regular file.""" path = Path(arg).resolve() if not path.is_file(): sys.exit(f"not a readable file: {arg}") + try: + with path.open("rb"): + pass + except OSError: + sys.exit(f"not a readable file: {arg}") return path def call(method, params): diff --git a/tools/spectral_camera_table.py b/tools/spectral_camera_table.py index 0e6fef7df..188f6ba4c 100644 --- a/tools/spectral_camera_table.py +++ b/tools/spectral_camera_table.py @@ -35,6 +35,8 @@ def _out_path(arg): path = Path(arg).resolve() if not path.parent.is_dir(): sys.exit(f"output directory does not exist: {arg}") + if path.exists() and not path.is_file(): + sys.exit(f"output path is not a regular file: {arg}") return str(path) WL = np.arange(380, 781, 5)