Compare commits

...
Author SHA1 Message Date
Dylan M. Taylor 3a9b35c687 ci: exclude dev tool scripts from SonarCloud coverage gate
tools/ and docs/ scripts aren't unit-tested; exclude them from coverage so the
new-code coverage gate doesn't block hardening-only changes.
2026-10-21 17:31:18 -04:00
Dylan M. Taylor 68d5118a9d security: validate CLI paths/args in dev tools (SonarCloud S2083/S8707/S8705/S7044)
Resolve and validate command-line path arguments before use, enforce HTTPS at
download sinks, and confirm path containment. Hardens local codegen/fetch tools
against path-traversal and command-argument-injection findings.
2026-10-21 17:13:05 -04:00
3 changed files with 30 additions and 2 deletions

No files matched your search

+11 -1
View File
@@ -1,6 +1,16 @@
#!/usr/bin/env python3
"""lcb.py FILE.jsonl — run control requests from a JSON-lines file ({"method":..., "params":...} or {"sleep": s})."""
import json, socket, sys, time
from pathlib import Path
def _jsonl_path(arg):
"""Resolve the CLI file argument; require an existing regular file."""
path = Path(arg).resolve()
if not path.is_file():
sys.exit(f"not a readable file: {arg}")
return path
def call(method, params):
s = socket.create_connection(("127.0.0.1", 7980), timeout=180)
s.sendall((json.dumps({"id": 1, "method": method, "params": params}) + "\n").encode())
@@ -10,7 +20,7 @@ def call(method, params):
if not c: break
buf += c
return json.loads(buf)
for line in open(sys.argv[1]):
for line in open(_jsonl_path(sys.argv[1])):
line = line.strip()
if not line or line.startswith("#"): continue
r = json.loads(line)
+1
View File
@@ -1,2 +1,3 @@
sonar.projectKey=storytold_lightcraft
sonar.organization=storytold
sonar.coverage.exclusions=**/tools/**,**/docs/**,**/examples/**
+18 -1
View File
@@ -19,6 +19,23 @@ import sys
import colour
import numpy as np
from scipy.optimize import minimize
from pathlib import Path
def _existing_dir(arg):
"""Resolve a directory CLI argument; require it to exist."""
path = Path(arg).resolve()
if not path.is_dir():
sys.exit(f"not a directory: {arg}")
return str(path)
def _out_path(arg):
"""Resolve an output path CLI argument; require its parent to exist."""
path = Path(arg).resolve()
if not path.parent.is_dir():
sys.exit(f"output directory does not exist: {arg}")
return str(path)
WL = np.arange(380, 781, 5)
D50 = colour.xy_to_XYZ(colour.CCS_ILLUMINANTS["CIE 1931 2 Degree Standard Observer"]["D50"])
@@ -119,4 +136,4 @@ def main(root, out):
if __name__ == "__main__":
if len(sys.argv) != 3:
sys.exit("usage: spectral_camera_table.py <rawtoaces-data checkout> <output .rs>")
main(sys.argv[1], sys.argv[2])
main(_existing_dir(sys.argv[1]), _out_path(sys.argv[2]))