From 6983ea19f146d83bdf44898d079914f188a42b21 Mon Sep 17 00:00:00 2001 From: Codex Date: Sat, 18 Jul 2026 07:20:36 +0200 Subject: [PATCH] Limit RC10 manifest traversal --- backend/tests/test_rc10_data_operations.py | 12 ++++++++++++ scripts/audit_data_operations.py | 6 +++++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/backend/tests/test_rc10_data_operations.py b/backend/tests/test_rc10_data_operations.py index 809891d3..6cf7c88a 100644 --- a/backend/tests/test_rc10_data_operations.py +++ b/backend/tests/test_rc10_data_operations.py @@ -161,6 +161,18 @@ def test_referenced_tile_manifest_protects_its_tiles(tmp_path: Path) -> None: assert tile.resolve() in expanded +def test_ordinary_json_export_is_not_treated_as_an_artifact_manifest(tmp_path: Path) -> None: + audit = load_script("audit_data_operations.py") + storage = tmp_path / "storage" + export = storage / "exports" / "project" / "report.json" + export.parent.mkdir(parents=True) + export.write_text(json.dumps({"dataset_id": "not-a-file"}), encoding="utf-8") + + expanded = audit.expand_manifest_references({export.resolve()}, storage) + + assert expanded == {export.resolve()} + + def test_disk_pressure_uses_absolute_headroom_for_large_arrays( tmp_path: Path, monkeypatch: pytest.MonkeyPatch, diff --git a/scripts/audit_data_operations.py b/scripts/audit_data_operations.py index 92de8cd5..a8f88a74 100644 --- a/scripts/audit_data_operations.py +++ b/scripts/audit_data_operations.py @@ -170,7 +170,11 @@ def expand_manifest_references(references: set[Path], storage_root: Path) -> set root = storage_root.resolve() expanded = set(references) for manifest in list(references): - if manifest.suffix.lower() != ".json" or not manifest.is_file(): + if ( + manifest.suffix.lower() != ".json" + or "manifest" not in manifest.name.lower() + or not manifest.is_file() + ): continue try: if manifest.stat().st_size > 16 * 1024 * 1024: