fix: correct path security validator behaviour on mac os

fix: correct path security validator behaviour on mac os

Author: butler54

tests/trestle/core/remote/cache_security_test.py

@@ -16,6 +16,7 @@
 """Security tests for cache path traversal vulnerabilities."""
 
 import pathlib
+import sys
 
 import pytest
 
@@ -207,6 +208,7 @@ def test_validate_local_file_path_outside_workspace_allowed(self, tmp_path: path
         # Should not raise
         PathSecurityValidator.validate_local_file_path(workspace, outside_file, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_etc_passwd(self, tmp_path: pathlib.Path) -> None:
         """Test that /etc/passwd is blocked even with allow_outside_workspace=True."""
         workspace = tmp_path / 'workspace'
@@ -217,6 +219,7 @@ def test_validate_local_file_path_blocks_etc_passwd(self, tmp_path: pathlib.Path
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, passwd_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_etc_shadow(self, tmp_path: pathlib.Path) -> None:
         """Test that /etc/shadow is blocked."""
         workspace = tmp_path / 'workspace'
@@ -227,6 +230,7 @@ def test_validate_local_file_path_blocks_etc_shadow(self, tmp_path: pathlib.Path
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, shadow_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_etc_group(self, tmp_path: pathlib.Path) -> None:
         """Test that /etc/group is blocked."""
         workspace = tmp_path / 'workspace'
@@ -237,6 +241,7 @@ def test_validate_local_file_path_blocks_etc_group(self, tmp_path: pathlib.Path)
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, group_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_etc_sudoers(self, tmp_path: pathlib.Path) -> None:
         """Test that /etc/sudoers is blocked."""
         workspace = tmp_path / 'workspace'
@@ -247,6 +252,7 @@ def test_validate_local_file_path_blocks_etc_sudoers(self, tmp_path: pathlib.Pat
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, sudoers_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_ssh_directory(self, tmp_path: pathlib.Path) -> None:
         """Test that .ssh directory is blocked."""
         workspace = tmp_path / 'workspace'
@@ -257,6 +263,7 @@ def test_validate_local_file_path_blocks_ssh_directory(self, tmp_path: pathlib.P
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, ssh_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_aws_credentials(self, tmp_path: pathlib.Path) -> None:
         """Test that .aws credentials are blocked."""
         workspace = tmp_path / 'workspace'
@@ -267,6 +274,7 @@ def test_validate_local_file_path_blocks_aws_credentials(self, tmp_path: pathlib
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, aws_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_docker_config(self, tmp_path: pathlib.Path) -> None:
         """Test that .docker config is blocked."""
         workspace = tmp_path / 'workspace'
@@ -277,6 +285,7 @@ def test_validate_local_file_path_blocks_docker_config(self, tmp_path: pathlib.P
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, docker_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_kube_config(self, tmp_path: pathlib.Path) -> None:
         """Test that .kube config is blocked."""
         workspace = tmp_path / 'workspace'
@@ -287,6 +296,7 @@ def test_validate_local_file_path_blocks_kube_config(self, tmp_path: pathlib.Pat
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, kube_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_proc_environ(self, tmp_path: pathlib.Path) -> None:
         """Test that /proc/self/environ is blocked."""
         workspace = tmp_path / 'workspace'
@@ -317,6 +327,7 @@ def test_validate_local_file_path_blocks_windows_credentials(self, tmp_path: pat
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, cred_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_var_log(self, tmp_path: pathlib.Path) -> None:
         """Test that /var/log is blocked."""
         workspace = tmp_path / 'workspace'
@@ -327,6 +338,7 @@ def test_validate_local_file_path_blocks_var_log(self, tmp_path: pathlib.Path) -
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, log_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_blocks_mysql_data(self, tmp_path: pathlib.Path) -> None:
         """Test that MySQL data directory is blocked."""
         workspace = tmp_path / 'workspace'
@@ -337,6 +349,7 @@ def test_validate_local_file_path_blocks_mysql_data(self, tmp_path: pathlib.Path
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, mysql_path, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_case_insensitive(self, tmp_path: pathlib.Path) -> None:
         """Test that sensitive path checking is case-insensitive."""
         workspace = tmp_path / 'workspace'
@@ -348,6 +361,7 @@ def test_validate_local_file_path_case_insensitive(self, tmp_path: pathlib.Path)
         with pytest.raises(TrestleError, match='Attempt to access potentially sensitive system file'):
             PathSecurityValidator.validate_local_file_path(workspace, passwd_upper, allow_outside_workspace=True)
 
+    @pytest.mark.skipif(sys.platform == 'win32', reason='Unix-specific sensitive paths')
     def test_validate_local_file_path_checks_original_and_resolved(self, tmp_path: pathlib.Path) -> None:
         """Test that both original and resolved paths are checked for sensitive patterns."""
         workspace = tmp_path / 'workspace'

trestle/core/remote/security.py

@@ -228,7 +228,7 @@ def validate_local_file_path(
             '/root/.gnupg',
             # macOS specific
             '/Library/Keychains',
-            '/Users/',  # Broad but catches user home directories
+            '/Library/',  # Broad but catches user home directories
             # Windows system directories
             'C:\\Windows\\System32',
             'C:\\Windows\\SysWOW64',