fix(sidecar): allowlist band-math AST and assert Sedona limit

Reject bytes/tuple allocations before eval, and lock the SQL overflow
test to MAX_FEATURES + 1 so the bound cannot drift silently.

Author: Ayush7614

backend/geolibre_server/geolibre_server/app/raster.py

@@ -1027,46 +1027,59 @@ def load_bands(path, letter, namespace, base):
 namespace.update(safe_funcs)
 # Band arrays are full ndarrays, so attribute access (``A.tofile(...)``,
 # ``A.dump(...)``) would still write files even with an empty ``__builtins__``
-# and no bare ``np``. Parse the expression and reject attribute access plus any
-# call that is not one of the curated safe functions before ``eval``.
+# and no bare ``np``. Allowlist the expression AST before ``eval`` so only
+# curated calls/operators run — and so list/bytes/tuple multiplication cannot
+# allocate unbounded memory before the shape check.
 try:
     tree = ast.parse(expression, mode="eval")
 except SyntaxError as exc:
     raise SystemExit(f"Failed to evaluate expression: {exc}") from exc
 allowed_calls = set(safe_funcs)
+_allowed_nodes = (
+    ast.Expression,
+    ast.Name,
+    ast.Load,
+    ast.Constant,
+    ast.Call,
+    ast.BinOp,
+    ast.UnaryOp,
+    ast.BoolOp,
+    ast.Compare,
+    ast.IfExp,
+    ast.Add,
+    ast.Sub,
+    ast.Mult,
+    ast.Div,
+    ast.FloorDiv,
+    ast.Mod,
+    ast.Pow,
+    ast.UAdd,
+    ast.USub,
+    ast.Not,
+    ast.And,
+    ast.Or,
+    ast.Eq,
+    ast.NotEq,
+    ast.Lt,
+    ast.LtE,
+    ast.Gt,
+    ast.GtE,
+    ast.keyword,
+)
 for node in ast.walk(tree):
-    if isinstance(node, ast.Attribute):
+    if not isinstance(node, _allowed_nodes):
         raise SystemExit(
-            "Expression may not access attributes "
+            f"Expression may not use {type(node).__name__} "
             "(band math only allows curated functions and operators)"
         )
-    # Reject containers/comprehensions so expressions like ``[0] * 10**9``
-    # cannot allocate unbounded memory before the shape check runs.
-    if isinstance(
-        node,
-        (
-            ast.List,
-            ast.Dict,
-            ast.Set,
-            ast.ListComp,
-            ast.DictComp,
-            ast.SetComp,
-            ast.GeneratorExp,
-        ),
-    ):
+    if isinstance(node, ast.Constant) and not isinstance(node.value, (int, float, bool)):
         raise SystemExit(
-            "Expression may not build lists, dicts, or comprehensions "
+            "Expression may only use numeric constants "
             "(band math only allows curated functions and operators)"
         )
     if isinstance(node, ast.Call):
         # ``np.where(...)`` / ``A.tofile(...)`` parse as Attribute-backed calls;
-        # reject them the same way as bare attribute access so ndarray file I/O
-        # and the withheld ``np`` module stay unreachable.
-        if isinstance(node.func, ast.Attribute):
-            raise SystemExit(
-                "Expression may not access attributes "
-                "(band math only allows curated functions and operators)"
-            )
+        # Attribute is already rejected above, but keep an explicit Name check.
         if not isinstance(node.func, ast.Name) or node.func.id not in allowed_calls:
             name = node.func.id if isinstance(node.func, ast.Name) else type(node.func).__name__
             raise SystemExit(f"Call to '{name}' is not allowed in band math")

backend/geolibre_server/tests/test_raster.py

@@ -637,6 +637,7 @@ def test_raster_calculator_blocks_numpy_io(tmp_path: Path) -> None:
     combined = completed.stdout + completed.stderr
     assert (
         "Failed to evaluate expression" in combined
+        or "may not use" in combined
         or "may not access attributes" in combined
         or "not allowed in band math" in combined
     )
@@ -1056,6 +1057,39 @@ def test_raster_calculator_blocks_ndarray_tofile(tmp_path: Path) -> None:
     )
     assert completed.returncode != 0
     combined = completed.stdout + completed.stderr
-    assert "may not access attributes" in combined
+    assert "may not use" in combined or "may not access attributes" in combined
     assert not evil.exists()
     assert not out.exists()
+
+
+@requires_rasterio
+def test_raster_calculator_rejects_unbounded_allocations(tmp_path: Path) -> None:
+    """List/bytes/tuple multiplication must not allocate before the shape check."""
+    src = _write_dem(tmp_path / "dem.tif")
+    out = tmp_path / "calc.tif"
+    for expression in (
+        "[0] * 10**9",
+        'b"x" * 10**9',
+        "(0,) * 10**9",
+    ):
+        completed = subprocess.run(
+            [
+                sys.executable,
+                "-c",
+                _RASTER_TOOL_SCRIPTS["raster-calc"],
+                json.dumps(
+                    {
+                        "input_path": str(src),
+                        "output_path": str(out),
+                        "expression": expression,
+                    }
+                ),
+            ],
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+        assert completed.returncode != 0, expression
+        combined = completed.stdout + completed.stderr
+        assert "may not use" in combined or "numeric constants" in combined, expression
+        assert not out.exists()

backend/geolibre_server/tests/test_sql.py

@@ -127,6 +127,7 @@ def test_run_rejects_oversized_layer(monkeypatch: pytest.MonkeyPatch) -> None:
 def test_run_rejects_oversized_result(monkeypatch: pytest.MonkeyPatch) -> None:
     """Query results that expand past MAX_FEATURES are refused with 413."""
     monkeypatch.setattr(sedona_ops, "MAX_FEATURES", 1)
+    limited_to: list[int] = []
 
     class _FakeFrame:
         def __len__(self) -> int:
@@ -140,7 +141,8 @@ def to_dict(self, orient: str):  # noqa: ARG002
             return [{"n": 1}, {"n": 2}]
 
     class _FakeResult:
-        def limit(self, n: int):  # noqa: ARG002
+        def limit(self, n: int) -> "_FakeResult":
+            limited_to.append(n)
             return self
 
         def to_pandas(self):
@@ -169,3 +171,4 @@ def close(self) -> None:
         sql_run(SqlRunRequest(sql="SELECT 1 AS n UNION ALL SELECT 2 AS n"))
     assert exc.value.status_code == 413
     assert "Query result exceeds" in str(exc.value.detail)
+    assert limited_to == [sedona_ops.MAX_FEATURES + 1]