Jens and Claude Opus 5
e2f586c029
consume only artifacts the runtime produced
...
tile_manifest_path arrives in the detection and segmentation request and was
read straight off disk, and a manifest entry may name an absolute tile path.
That makes an API field an unbounded reference to the host filesystem, and it
contradicts the rule the persistence model rests on: only a governed,
runtime-produced artifact may be consumed, and a file outside the storage root
is not one.
Both the manifest and every tile it names now resolve under STORAGE_ROOT.
Resolution happens before the comparison, so ".." cannot climb out and a
sibling that merely shares a name prefix does not pass.
GEOINTEL_ALLOW_EXTERNAL_ARTIFACT_PATHS opts out for provisioning workflows that
stage tiles before ingest.
The check honours the Settings the caller is operating under rather than the
process-wide ones, because every analysis path already threads its own.
The affected tests write manifests into tmp_path, so they now declare tmp_path
as the storage root — which is what a deployment does, and makes the fixtures
more honest than they were.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
2026-08-22 16:16:25 +02:00
..
2026-07-19 12:07:04 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-08-10 04:44:29 +02:00
2026-07-30 12:38:04 +02:00
2026-06-16 23:36:32 +02:00
2026-08-09 22:36:27 +02:00
2026-08-01 15:18:06 +02:00
2026-06-16 23:36:32 +02:00
2026-07-11 23:04:54 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-08-09 10:54:52 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-08-22 16:16:25 +02:00
2026-07-19 12:07:04 +02:00
2026-06-16 23:36:32 +02:00
2026-07-26 00:45:44 +02:00
2026-07-26 05:23:33 +02:00
2026-06-16 23:36:32 +02:00
2026-07-19 04:07:01 +02:00
2026-07-29 18:32:44 +02:00
2026-06-16 23:36:32 +02:00
2026-07-19 12:07:04 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-07-18 04:41:23 +02:00
2026-06-16 23:36:32 +02:00
2026-07-18 07:59:38 +02:00
2026-06-16 23:36:32 +02:00
2026-08-21 22:48:07 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-07-22 06:28:46 +02:00
2026-07-18 07:32:57 +02:00
2026-06-16 23:36:32 +02:00
2026-07-22 06:28:46 +02:00
2026-07-22 06:28:46 +02:00
2026-08-01 23:46:17 +02:00
2026-06-16 23:36:32 +02:00
2026-07-14 20:07:03 +02:00
2026-07-16 03:06:36 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-08-01 16:06:15 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-07-09 10:55:45 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-08-21 21:50:40 +02:00
2026-07-16 22:14:48 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-07-19 12:07:04 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-08-22 15:59:01 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-07-19 12:07:04 +02:00
2026-06-16 23:36:32 +02:00
2026-07-18 07:59:38 +02:00
2026-07-27 23:28:43 +02:00
2026-06-16 23:36:32 +02:00
2026-07-26 21:48:00 +02:00
2026-07-26 22:29:02 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-07-18 08:33:40 +02:00
2026-07-18 00:12:34 +02:00
2026-07-18 08:33:40 +02:00
2026-06-16 23:36:32 +02:00
2026-07-19 12:07:04 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-07-18 00:53:00 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-07-19 04:07:01 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-08-21 22:35:17 +02:00
2026-06-16 23:36:32 +02:00
2026-07-19 16:38:17 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00
2026-07-18 06:37:54 +02:00
2026-07-26 00:48:09 +02:00
2026-06-16 23:36:32 +02:00
2026-06-16 23:36:32 +02:00