From 42cbd91277e8c504b27ee9f25365be1d02aed887 Mon Sep 17 00:00:00 2001 From: Michael D'Angelo Date: Thu, 13 Aug 2026 17:12:19 -0700 Subject: [PATCH] refactor(workbench): share safe source path validation --- .../_bundled_plugin/scripts/workbench_db.py | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/sdk/typescript/_bundled_plugin/scripts/workbench_db.py b/sdk/typescript/_bundled_plugin/scripts/workbench_db.py index c672442d..732fb5b8 100644 --- a/sdk/typescript/_bundled_plugin/scripts/workbench_db.py +++ b/sdk/typescript/_bundled_plugin/scripts/workbench_db.py @@ -97,7 +97,7 @@ from workbench_schema import ( sql_statements as sql_statements, ) -from workbench_source_excerpt import finding_source_excerpt +from workbench_source_excerpt import finding_source_excerpt, safe_source_path from workbench_target import ( clean_worktree_content_digest, copy_directory_excluding, @@ -3462,20 +3462,6 @@ def patch_artifact_preview( } -def safe_source_path(target: Path, relative_path: str) -> Path | None: - if "\\" in relative_path: - return None - parsed = PurePosixPath(relative_path) - if parsed.is_absolute() or ".." in parsed.parts: - return None - try: - path = (target / parsed.as_posix()).resolve() - path.relative_to(target) - except (OSError, RuntimeError, ValueError): - return None - return path - - def available_artifact_path(scan_dir: Path, candidate: Path) -> Path | None: try: resolved_scan_dir = require_canonical_scan_directory(scan_dir)