more secure ssh copy (#52)

ecmwf · Nov 15, 2024 · 809d847 · 809d847
1 parent b6e35c4
commit 809d847
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/src/anemoi/utils/remote/ssh.py b/src/anemoi/utils/remote/ssh.py
@@ -44,6 +44,9 @@ def _parse_target(self, target):
             hostnames = hostname.split("+")
             hostname = hostnames[random.randint(0, len(hostnames) - 1)]
 
+        if ".." in path.split("/"):
+            raise Exception("Path contains suspicious '..' : {target}")
+
         return hostname, path
 
     def get_temporary_target(self, target, pattern):

diff --git a/tests/test_remote.py b/tests/test_remote.py
@@ -151,7 +151,7 @@ def test_transfer_local_to_s3_to_local(path):
 
 
 @pytest.mark.skipif(IN_CI, reason="Test requires ssh access to localhost")
-@pytest.mark.parametrize("path", ["directory", "directory/", "file"])
+@pytest.mark.parametrize("path", ["directory", "file"])
 @pytest.mark.parametrize("temporary_target", [True, False])
 def test_transfer_local_to_ssh(path, temporary_target):
     local = LOCAL_TEST_DATA + "/" + path