o i7 @shddlZddlZddlmZddZddZddZdd Zd d Zd d Z ddZ ddZ ddZ dS)NcCntt tdWdn1swYtttdWddS1s0wYdS)z3No-protocol traversal sequences should be rejected.../../etc/passwdNz../relative/../etc/passwdpytestraises ValueErrordatanormalize_resource_urlr r U/home/ubuntu/.local/lib/python3.10/site-packages/nltk/test/unit/test_data_security.py,test_normalize_rejects_no_protocol_traversals    "r cC:tttdWddS1swYdS)zQWindows-style backslash traversal should be rejected when no protocol is present.z..\..\etc\passwdNrr r r r .test_normalize_rejects_no_protocol_backslashes  "rcCs td}|dsJddS)zIValid package-style resource names should still be treated as nltk: URLs.z corpora/brownznltk:z5Package-style paths should be treated as 'nltk:' URLsN)rr startswith)outr r r #test_normalize_allows_package_pathss rcCr )zLDefense-in-depth: direct calls to find() should reject traversal-like names.rNrrrrfindr r r r 'test_find_rejects_traversal_direct_callrrcCr )z Defense-in-depth edge case: a path can become unsafe only after normalization. Example from review: "foo/../../etc/passwd" normalizes to "../etc/passwd" and must still be rejected. zfoo/../../etc/passwdNrr r r r Ctest_find_rejects_traversal_that_becomes_unsafe_after_normalization%s  "rcCr )z;Absolute POSIX paths without a protocol should be rejected.z /etc/passwdNrr r r r 6test_normalize_rejects_no_protocol_absolute_posix_path0rrcCr)z Windows drive letter paths should be rejected even on non-Windows platforms. Review note: don't gate 'C:/etc/passwd' on Windows only; ensure robust rejection regardless of runtime platform. z C:\etc\passwdNz C:/etc/passwdrr r r r =test_normalize_rejects_no_protocol_windows_drive_letter_paths6s    "rcCr )z8A resource name that is exactly '..' should be rejected.z..Nrr r r r .test_normalize_rejects_no_protocol_dotdot_onlyErrcCs|d}t|d}|ddWdn1swYtjdt|gd}|}|}t|t r=| d}|dksCJWddS1sNwYdS)Nza.zipwz b.zip/c.txtokza.zip/b.zip/c.txt)pathszutf-8) zipfileZipFilewritestrrrstropenread isinstancebytesdecode)tmp_pathzpathzfptrfgotr r r !test_find_zip_split_is_non_greedyKs   "r,) rr nltk.datarr rrrrrrrr,r r r r s