validation.py
python
sha256:34035d72cef530c1ab9d6a6f53be18d803dde705fc3157617d70352a96d0747b
Merge branch 'fix/wire-push-external-parent-manifest' into dev
Human
8 days ago
| 1 | """Validated path-segment types for FastAPI route parameters. |
| 2 | |
| 3 | All URL path segments that come from user input are validated against an |
| 4 | allowlist regex and capped at a safe length. FastAPI enforces these at |
| 5 | decode time and returns 422 Unprocessable Entity on violation — before any |
| 6 | handler logic runs. |
| 7 | |
| 8 | Usage in route signatures:: |
| 9 | |
| 10 | from musehub.api.validation import SlugParam, BranchParam, FilePathParam |
| 11 | |
| 12 | async def my_route(owner: SlugParam, repo_slug: SlugParam, branch: BranchParam): |
| 13 | ... |
| 14 | """ |
| 15 | |
| 16 | from typing import Annotated |
| 17 | |
| 18 | from fastapi import Path |
| 19 | |
| 20 | # owner / slug / repo_slug — alphanumeric, underscore, hyphen, dot. |
| 21 | # Must start with alphanumeric. Max 100 characters. |
| 22 | # Blocks: slashes, null bytes, "..", shell metacharacters, Unicode overlong sequences. |
| 23 | _SLUG_RE = r"^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,99}$" |
| 24 | |
| 25 | # branch — same charset as slug but allows "/" for branch namespaces (e.g. feat/foo). |
| 26 | # Pydantic uses Rust's regex engine which does not support lookaheads, so we |
| 27 | # block ".." structurally: each path component must start with [a-zA-Z0-9_], |
| 28 | # meaning no component can be "." or "..". |
| 29 | # Pattern: one or more components of the form [a-zA-Z0-9_][a-zA-Z0-9_.-]*, |
| 30 | # optionally separated by "/". Max 200 characters. |
| 31 | _BRANCH_RE = r"^[a-zA-Z0-9_][a-zA-Z0-9_.-]*(/[a-zA-Z0-9_][a-zA-Z0-9_.-]*)*$" |
| 32 | |
| 33 | # file path inside a repo (e.g. "src/main.py", "README.md"). |
| 34 | # Each path component is either: |
| 35 | # - a normal name: starts with [a-zA-Z0-9_] |
| 36 | # - a dotfile: starts with "." followed immediately by [a-zA-Z0-9_] |
| 37 | # This structurally blocks ".", "..", and traversal sequences without lookaheads. |
| 38 | # Max 1000 characters enforced by max_length on the Path() field info. |
| 39 | _SEGMENT = r"(?:\.[a-zA-Z0-9_]|[a-zA-Z0-9_])[a-zA-Z0-9_.-]*" |
| 40 | _FILE_PATH_RE = rf"^{_SEGMENT}(\/{_SEGMENT})*$" |
| 41 | |
| 42 | SlugParam = Annotated[ |
| 43 | str, |
| 44 | Path(pattern=_SLUG_RE, max_length=100, min_length=1), |
| 45 | ] |
| 46 | |
| 47 | BranchParam = Annotated[ |
| 48 | str, |
| 49 | Path(pattern=_BRANCH_RE, max_length=200, min_length=1), |
| 50 | ] |
| 51 | |
| 52 | FilePathParam = Annotated[ |
| 53 | str, |
| 54 | Path(pattern=_FILE_PATH_RE, max_length=1000, min_length=1), |
| 55 | ] |
File History
14 commits
sha256:34035d72cef530c1ab9d6a6f53be18d803dde705fc3157617d70352a96d0747b
Merge branch 'fix/wire-push-external-parent-manifest' into dev
Human
8 days ago
sha256:fc04e4cae9e1774d6a21b65c45daeed0e6787eb581d13aa1b03bfe9384a34226
Merge branch 'fix/two-column-scroll-layout' into dev
Human
8 days ago
sha256:408916fc5973ba59c6e4eebaa80ebdcc801c0a63205651e25009d11548f79454
chore: bump version to 0.2.0.dev2 — nightly.2, matching muse
Sonnet 4.6
patch
11 days ago
sha256:d035733f21ccff27735fddebfbbe0ed24565a32a22db8de5885402262671ecd2
chore: bump version to 0.2.0rc15 for musehub#113 fix release
Sonnet 4.6
patch
14 days ago
sha256:0032d6cfa33bc3c8367436ad768e7dd0e339b4332153160247da8266cb5fa352
Merge branch 'task/version-tags-phase3-server' into dev
Human
17 days ago
sha256:4669620efda9ff41c55bdefd1f7bfe1c239d468428744c84ead9957e5a003a53
merge: rescue snapshot-recovery hardening (c00aa21d) into d…
Opus 4.8
minor
⚠
29 days ago
sha256:a59da49c4611b970fc4b6ae48678ce4943261c213a07ddbd73ce9201df869b4a
fix: remove false-positive proposal_comments index drop fro…
Sonnet 4.6
patch
33 days ago
sha256:0a240d6dbff234f07d98a28a4a9a68db702f3f9ff9260196f24219bdb1c0b6f3
feat: render markdown mists as HTML with heading anchor links
Sonnet 4.6
patch
34 days ago
sha256:24a7d47486ebc4ebd1832830580e177ec6f877b48dced8c000e198cdec4ce9d6
Merge 'task/bump-version-rc12' into 'dev' — proposal: Bump …
Human
35 days ago
sha256:b9ff931d147e0114a1f17060f415b89ed551c170a91ff226c70437aa5c85f9ee
Merge 'task/bump-version-rc12' into 'dev' — proposal: Bump …
Human
35 days ago
sha256:d1122d21e73471879b460037b22c0b50fded7c423444a176f248428f75dac39c
Merge 'task/fix-issue-pagination-cursor' into 'dev' — propo…
Human
35 days ago
sha256:01e18975e73d2b3cd5b6db7929c895bef9aa6e0d4391dc5b2adfc548b41318dd
Merge 'feat/adding-debug-logs-to-staging' into 'dev' — prop…
Human
35 days ago
sha256:6b1949fc2797ca4c1936a637a4cbfec828ef56cf52398a2e74ca3c4f494e728f
fix: use wire_bytes not mpack_bytes_raw in compute_object_b…
Sonnet 4.6
patch
48 days ago
sha256:b99f2455dc346966d040133f5203297e6e3ef5803a93728a2c30568d0a0f7583
rename: delta_add → delta_upsert across wire format, models…
Sonnet 4.6
patch
50 days ago