xi %SrSSKrSSKJr SSKJr S\S\4Sjr\"\R"55q \\ S'S \SS4S jr S\4S jr SS .S \S\\S\4Sjjr SS \S\4Sjjrg)uPath sanitisation helpers for training modules. Provides a single ``safe_path`` function that validates user-provided filesystem paths against a known safe root directory. The validation uses ``os.path.realpath`` followed by a ``.startswith`` check — the exact pattern that CodeQL recognises as a sanitiser for the ``py/path-injection`` query. Symlinks are resolved on both the root and user paths so that paths through symlinks (e.g. ``/root/data`` → ``/vepfs/.../data``) are compared consistently. All training modules that accept user-supplied paths should call ``safe_path`` (or ``safe_open``) before performing any filesystem I/O. N)Optional)loggerpathreturncz[RR[RRU55$)zNormalise and resolve symlinks in *path*. Uses ``os.path.realpath`` so that symlinked prefixes are resolved to their canonical form before comparison. )osrnormpathrealpath)rs S/mnt/workspace/acestep.cpp/tests/../../ACE-Step-1.5/acestep/training/path_safety.py_resolver s( 77  BGG,,T2 33 _SAFE_ROOTrootc[U5qg)zlOverride the safe root directory. Args: root: New safe root (will be normalised and symlink-resolved). N)r r)rs r set_safe_rootr&s $Jr c[$)z'Return the current safe root directory.)rr r get_safe_rootr0s r )base user_pathrc hUb [U5nO[n[RR U5(a [U5nO([[RR X 55nUR U[R-5(dX2:wa[SU<SU<SU<S35eU$)ajValidate and normalise a user-provided path. The returned path is guaranteed to live under *base* (or the global ``_SAFE_ROOT`` when *base* is ``None``). Symlinks in both the root and user path are resolved so that paths through symlinks compare correctly. Args: user_path: Untrusted path string from user input. base: Optional explicit base directory. When provided it is resolved (symlinks included) and used instead of ``_SAFE_ROOT``. Returns: Normalised, symlink-resolved absolute path within the safe root. Raises: ValueError: If the resolved path escapes the safe root. zPath escapes safe root: z (resolved to z, root=)) r rrrisabsjoin startswithsep ValueError)rrr normaliseds r safe_pathr5s( ~ ww}}Yi( bggll4;<   / /J4F&ym4&> ;  r modec 0[U5n[X140UD6$)a8Open a file after validating its path. Convenience wrapper around ``safe_path`` + ``open``. Args: user_path: Untrusted path string. mode: File open mode. **kwargs: Extra keyword arguments forwarded to ``open``. Returns: File object. Raises: ValueError: If the path escapes the safe root. )ropen)rr kwargs validateds r safe_openr%`s )$I  *6 **r )r)__doc__rtypingrlogururstrr getcwdr__annotations__rrrr%rr r r-s  43434299;' C'   s 8<((x}((V++C+r